fix: native ESM interop, real ES5 runtime support, and CI across Node.js, browsers, Deno and Bun

.babelrc

@@ -5,6 +5,9 @@
                 ["@babel/preset-env", {
                     "modules": false
                 }]
+            ],
+            "plugins": [
+                "./scripts/babel-plugin-fully-specified"
             ]
         },
         "development": {

.github/workflows/ci.yml

@@ -10,19 +10,21 @@ jobs:
     name: Build on Node.js 24
     steps:
       - name: Setup Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 24
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Install dependencies
         run: npm install
       - name: Build
         run: npm run build
       - name: Lint
         run: npm run lint
+      - name: Compile ES5 test suite
+        run: node scripts/build-es5-tests.js
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: build-artifacts
           path: |
@@ -31,24 +33,25 @@ jobs:
             es/
             validator.js
             validator.min.js
+            test-es5/
           retention-days: 1
 
   test:
     needs: build
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [24, 22, 20, 18, 16, 14, 12, 10, 8]
+        node-version: [26, 24, 22, 20, 18, 16, 14, 12, 10, 8]
     name: Run tests on Node.js ${{ matrix.node-version }}
     steps:
     - name: Setup Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
         node-version: ${{ matrix.node-version }}
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
     - name: Download build artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v8
       with:
         name: build-artifacts
     - name: Install dependencies
@@ -57,6 +60,189 @@ jobs:
       run: npm run test:ci
     - if: matrix.node-version == 24
       name: Send coverage info to Codecov
-      uses: codecov/codecov-action@v5
+      uses: codecov/codecov-action@v7
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
+
+  # Mocha, nyc and npm install do not work on these Node.js versions, so the
+  # suite compiled to ES5 by the build job runs with its own dependency-free
+  # runner, against the built index.js, lib/ and validator(.min).js.
+  test-es5:
+    needs: build
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ['0.10', '0.12', '4', '6']
+    name: Run ES5 test suite on Node.js ${{ matrix.node-version }}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v7
+    - name: Download build artifacts
+      uses: actions/download-artifact@v8
+      with:
+        name: build-artifacts
+    # actions/setup-node's version manifest starts at 6.17.1, so install with
+    # nvm like ljharb/actions does; it downloads and checksums nodejs.org builds.
+    - name: Install Node.js ${{ matrix.node-version }} with nvm
+      env:
+        NODE_VERSION: ${{ matrix.node-version }}
+      run: |
+        export NVM_DIR="$RUNNER_TEMP/nvm"
+        git -c advice.detachedHead=false clone --quiet --depth 1 --branch v0.40.3 https://github.com/nvm-sh/nvm.git "$NVM_DIR"
+        . "$NVM_DIR/nvm.sh"
+        nvm install "$NODE_VERSION"
+        echo "$NVM_BIN" >> "$GITHUB_PATH"
+    - name: Run ES5 test suite
+      run: |
+        node --version
+        node test-es5/run.js
+
+  browser:
+    needs: build
+    runs-on: ubuntu-latest
+    name: Run tests in Chromium, Firefox and WebKit
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    env:
+      # Pinned; installed with --no-save because Playwright needs a newer
+      # Node.js than the development dependencies support.
+      PLAYWRIGHT_VERSION: 1.63.0
+      REQUIREJS_VERSION: 2.3.8
+    steps:
+      - name: Setup Node.js 24
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Download build artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: build-artifacts
+      - name: Install dependencies, Playwright and RequireJS
+        run: npm install --legacy-peer-deps --no-save "playwright@$PLAYWRIGHT_VERSION" "requirejs@$REQUIREJS_VERSION"
+      - name: Install browsers
+        run: npx playwright install --with-deps chromium firefox webkit
+      - name: Run tests in browsers
+        run: npm run test:browser
+
+  # Packs the package and checks it the way users install it: the tarball file
+  # list, publint, CommonJS/ESM/deep-import consumers installed with npm, pnpm
+  # and Yarn (Plug'n'Play), and esbuild bundles (tree-shaking and sizes).
+  # See scripts/check-package.mjs; its tools are pinned there and run with npx.
+  package:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [26, 24, 22, 20]
+    name: Check the package on Node.js ${{ matrix.node-version }}
+    steps:
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Download build artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: build-artifacts
+      - name: Check the packed package
+        run: node scripts/check-package.mjs
+
+  # Runs the Mocha suite on Deno's Node.js compatibility layer, then imports
+  # the packed package (CommonJS, ESM, deep es/ paths) from a node_modules
+  # install with Deno. Tracks the latest Deno 2.x release.
+  deno:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    name: Run tests on Deno 2.x
+    steps:
+      - name: Setup Node.js 24
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Setup Deno 2.x
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Download build artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: build-artifacts
+      - name: Install dependencies
+        run: npm install --legacy-peer-deps
+      - name: Run tests
+        run: deno run -A node_modules/mocha/bin/_mocha --require @babel/register --reporter dot --recursive
+      - name: Check the packed package
+        run: node scripts/check-package.mjs --runtime=deno
+
+  # Same for Bun: the Mocha suite (Mocha itself, since `bun test` does not
+  # support Mocha's `this.timeout()`/`this.skip()`), then the packed package
+  # installed with `bun install`. Tracks the latest Bun 1.x release.
+  bun:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    name: Run tests on Bun 1.x
+    steps:
+      - name: Setup Node.js 24
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Setup Bun 1.x
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.x
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Download build artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: build-artifacts
+      - name: Install dependencies
+        run: npm install --legacy-peer-deps
+      - name: Run tests
+        run: bun node_modules/mocha/bin/_mocha --require @babel/register --reporter dot --recursive
+      - name: Check the packed package
+        run: node scripts/check-package.mjs --runtime=bun
+
+  # Keeps jsr.json publishable to JSR (dry run only; nothing is published).
+  # jsr@0.14.3 downloads and verifies a pinned Deno (v2.6.7) to run
+  # `deno publish`. The `unsupported-javascript-entrypoint` warning is expected
+  # until the package ships type declarations.
+  jsr:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    name: Check JSR publishing (dry run)
+    steps:
+      - name: Setup Node.js 24
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Publish to JSR (dry run)
+        run: npx --yes jsr@0.14.3 publish --dry-run --allow-dirty

.github/workflows/codeql-analysis.yml

@@ -38,11 +38,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +53,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -67,4 +67,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4

.github/workflows/npm-publish.yml

@@ -10,12 +10,12 @@ jobs:
       id-token: write
     steps:
     - name: Setup Node.js 24
-      uses: actions/setup-node@v5
+      uses: actions/setup-node@v7
       with:
         node-version: 24
         registry-url: https://registry.npmjs.org/
     - name: Checkout Repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
     - name: Install Dependencies
       run: npm install
     - name: Run Tests

.gitignore

@@ -10,4 +10,6 @@ yarn.lock
 /index.js
 validator.js
 validator.min.js
+/test-es5
+/deno.lock
 

AGENTS.md

@@ -6,10 +6,10 @@ This file provides guidance to AI coding agents working with this repository.
 
 - validator.js is a single-package npm project for string validation and sanitization.
 - `src/index.js` defines the public exports, and `src/lib` contains validators, sanitizers, normalizers, converters, static format data, and shared utilities.
-- `test/validators.test.js` contains most API tests; additional test files cover browser builds and individual utilities.
+- `test/validators.test.js` contains most API tests; additional test files cover browser builds, package exports, ES modules and individual utilities. `test/browser/` runs the suite in real browsers, and `test/fixtures/consumers/` holds the projects used by `scripts/check-package.mjs`.
 - `README.md` is the primary public API reference. Update it when documented API behavior or options change.
-- `build-browser.js` creates the browser bundle. Babel creates the Node and ES module distributions.
-- `index.js`, `lib/`, `es/`, `validator.js`, and `validator.min.js` are generated. Do not edit or commit them manually.
+- `build-browser.mjs` creates the browser bundle. Babel creates the Node and ES module distributions; small post-build steps in `scripts/` add the Node ESM export-name hint to `index.js`, `.js` extensions to `es/` imports, and `es/package.json`.
+- `index.js`, `lib/`, `es/`, `validator.js`, `validator.min.js`, and `test-es5/` are generated. Do not edit or commit them manually.
 - The published package contains only the generated distributions, `README.md`, `LICENSE`, and package metadata listed in the `files` field of `package.json`.
 - validator.js has no runtime dependencies. The packages in `devDependencies` are used only to build, lint, and test the project.
 
@@ -31,8 +31,10 @@ This file provides guidance to AI coding agents working with this repository.
 ## Test
 
 - `npm test` is the broad local check. Its `pretest` lifecycle builds every distribution and runs ESLint before the Mocha suite.
-- `npm run lint` checks `src/` and `test/`.
+- `npm run lint` checks `src/`, `test/`, `scripts/` and `build-browser.mjs`. `src/` must stay free of ES2015+ built-ins (`src/.eslintrc.js`), because the library supports ES5 runtimes without polyfills.
+- `npm run build` also checks that the CommonJS and browser builds parse as ES5 (`check:es5`).
 - `npm run build` builds all published forms without running the tests.
+- CI also runs `npm run test:es5` (Node.js 0.10–6), `npm run test:browser` (Playwright), `scripts/check-package.mjs` (packed-package consumers), the suite on Deno and Bun, and a JSR dry run.
 - For a focused Mocha run, use `npm test -- --grep '<test name>'`; retain the broad `npm test` run before considering a code change complete.
 - Tests use Mocha, Babel, and nyc. Coverage output under `coverage/` and `.nyc_output/` is generated and should not be committed.
 - When changing a shared helper, identify and test its public callers. A helper-level test alone does not establish public API behavior.

CONTRIBUTING.md

@@ -11,7 +11,7 @@ In general, we follow the "fork-and-pull" Git workflow.
     * Install the project using `npm install`
     * Make your changes and additions
         - Most of your changes should be focused on src/ and test/ folders and/or [README.md](https://github.com/validatorjs/validator.js/blob/master/README.md).
-        - Files such as validator.js, validator.min.js and files in lib/ folder are autogenerated when running tests (npm test) and need not to be changed **manually**.
+        - Files such as validator.js, validator.min.js and files in the lib/ and es/ folders are autogenerated when running tests (npm test) and need not to be changed **manually**.
     * Change or add tests if needed
     * Run tests and make sure they pass
     * Add changes to README.md if needed
@@ -28,6 +28,16 @@ Tests are using mocha. To run the tests use:
 $ npm test
 ```
 
+`npm test` builds every distribution, checks that the CommonJS and browser builds are ES5, lints, and runs the suite. The library supports ES5 runtimes without polyfills (Node.js 0.10+ and old browsers), so `src/` must not use ES2015+ built-ins such as `Set`, `Array.from` or `String.prototype.startsWith`; ESLint reports them, and `src/lib/util/` has ES5 helpers.
+
+CI runs some extra suites that you can also run locally after `npm run build`:
+
+```sh
+$ npm run test:es5      # the suite compiled to ES5, for running on old Node.js versions (e.g. with nvm)
+$ npm run test:browser  # the suite in Chromium, Firefox and WebKit (needs `playwright` and `requirejs`)
+$ node scripts/check-package.mjs  # packs the package and installs it into CommonJS/ESM/bundler test projects
+```
+
 ### Financial Contribution
 We welcome financial contributions on our [open collective](https://opencollective.com/validatorjs).