Check scripts required by entrypoint script

[obahareth]

Based on the issues with a couple of packages (#48, #53, #24), we need to check more than just the entry script. Right now we only check the entrypoint script, we need to check scripts required/imported by the entrypoint (up to a certain depth) to provide a more conclusive result. This is a bit difficult and I don't know how to do it in a way that works for all JavaScript engines (the different JS module formats, import vs require, etc.)

[CodyJamesCasey]

Hey there @obahareth! I believe that I'm actually running into this issue now!

One of my dependencies is the debug package: https://github.com/visionmedia/debug

In debug, the main field of its package.json file is "./src/index.js". This file is ES5. However, that file exports another file: module.exports = require('./browser.js');. And browser.js is ES6.

I'm also not entirely sure how you would check this, but I'll put my brain to it and see if I can help at all! Thanks so much for are-you-es5! It's incredibly useful.

[PatrickHollweck]

Hey, I think I am running into the same issue.

I currently depend on a package that uses es6 features but does not use the es6 module system.
The entry point to the library is just a simple module.exports = require("file.js"), which causes this module to not detect it as es6

However, implementing checks for imported files is non-trival. Since you somehow have to find out what file is being imported.

Basically you would have to walk the syntax-tree generated by acorn and then check for import statements, import() and require() function calls.

So far so simple, however if someone aliases the "require" function like var doRequire = require it would not work anymore.
It is also entirely possible that someone just made their own function named "require", just checking the function name is risky.

Another problem would be that dynamic require calls would not work. I am thinking of things like require("./versions/" + process.env.NODE_ENV)

If you really wanted to implement this though, you could deal with these problems by saying that if a function named "require" is used or a "require" call is dynamically constructed, we just treat it as ES6.

This could cause errors if someone relies on this to be 100% accurate. However, this module is mostly used in conjunction with babel to build a regex so including a module that is not really es6 is not be as big a deal.

I don't know if there are other ways of importing a script. There probably is... (Example: read file from fs, then use eval) however, we most likely cant detect those statically.

Therefore I suggest we only focus on "require". If you do intend to implement this.