chore: release v3.0.3

Fix critical ESM/CJS interop by disabling minification

- Disable minification in esbuild config (libraries should not be minified)
- Remove fix-commonjs-exports build step (no longer needed)
- Unminified esbuild output has clear __export patterns Node.js ESM understands
- Verified with real .mjs module imports from CJS dist

Author: jdalton

.config/esbuild.config.mjs

@@ -67,8 +67,8 @@ export const buildConfig = {
   platform: 'node',
   target: 'node18',
   sourcemap: true,
-  // Minify for production builds (can be overridden in watch mode)
-  minify: true,
+  // Don't minify - this is a library and minification breaks ESM/CJS interop
+  minify: false,
   // Tree-shaking optimization
   treeShaking: true,
   metafile: true,

CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.3](https://github.com/SocketDev/socket-lib/releases/tag/v3.0.3) - 2025-11-01
+
+### Fixed
+
+- **Critical: Node.js ESM/CJS interop completely fixed**: Disabled minification to ensure proper ESM named import detection
+  - Root cause: esbuild minification was breaking Node.js ESM's CJS named export detection
+  - Solution: Disabled minification entirely (`minify: false` in esbuild config)
+  - Libraries should not be minified - consumers minify during their own build process
+  - Unminified esbuild output uses clear `__export` patterns that Node.js ESM natively understands
+  - Removed `fix-commonjs-exports.mjs` build script - no longer needed with unminified code
+  - ESM imports now work reliably: `import { getDefaultLogger } from '@socketsecurity/lib/logger'`
+  - Verified with real-world ESM module testing (`.mjs` files importing from CJS `.js` dist)
+
 ## [3.0.2](https://github.com/SocketDev/socket-lib/releases/tag/v3.0.2) - 2025-11-01
 
 ### Fixed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
   "keywords": [

scripts/fix-build.mjs

@@ -1,6 +1,6 @@
 /**
  * @fileoverview Orchestrates all post-build fix scripts.
- * Runs generate-package-exports, fix-commonjs-exports, and fix-external-imports in sequence.
+ * Runs generate-package-exports and fix-external-imports in sequence.
  */
 
 import { isQuiet } from './utils/flags.mjs'
@@ -28,10 +28,7 @@ async function main() {
       args: ['scripts/generate-package-exports.mjs', ...fixArgs],
       command: 'node',
     },
-    {
-      args: ['scripts/fix-commonjs-exports.mjs', ...fixArgs],
-      command: 'node',
-    },
+    // fix-commonjs-exports no longer needed - unminified esbuild output is ESM-compatible
     {
       args: ['scripts/fix-external-imports.mjs', ...fixArgs],
       command: 'node',