From 734ab44b42121e31313ec170bcf5d42b7effebac Mon Sep 17 00:00:00 2001
From: Christopher Hiller <boneskull@boneskull.com>
Date: Fri, 8 Mar 2024 12:36:22 -0800
Subject: [PATCH] chore: use prefixed node builtins where appropriate

This change adds the `node:` prefix to (almost) all `require()` calls of Node.js builtins.

Two places were special cases:

1. In `viz`, old Webpack does not understand the `node:` prefix; this had to be exempted from the rule.
2. In `tofu`, I added another test to assert both prefixed and non-prefixed builtin references work as expected.

Note that test fixture projects are ignored by ESLint; they have not been changed.
---
 packages/aa/test/bench.js                     |  2 +-
 packages/allow-scripts/src/index.js           |  4 +-
 packages/allow-scripts/src/linker.js          |  2 +-
 packages/allow-scripts/src/setup.js           |  6 +--
 packages/allow-scripts/src/whichbin.js        |  2 +-
 .../browserify/src/createPackageDataStream.js |  2 +-
 packages/browserify/src/index.js              |  4 +-
 packages/browserify/src/sesTransforms.js      |  2 +-
 .../secureBundling/lavamoat/node/policy.json  | 21 +++++----
 packages/browserify/test/lavamoatNode.spec.js |  4 +-
 packages/browserify/test/policy.spec.js       |  4 +-
 packages/browserify/test/util.js              | 12 ++---
 packages/core/src/generateKernel.js           |  4 +-
 packages/core/src/generatePolicy.js           |  4 +-
 packages/core/test/builtin.spec.js            | 10 ++---
 packages/lavapack/src/builder-runtime.js      |  4 +-
 packages/lavapack/src/pack.js                 |  8 ++--
 packages/lavapack/test/index.spec.js          |  2 +-
 packages/node/src/freshRealmCompartment.js    |  2 +-
 packages/node/src/index.js                    |  4 +-
 packages/node/src/kernel.js                   |  4 +-
 packages/node/src/parseForPolicy.js           |  6 +--
 packages/node/src/run-command.js              |  4 +-
 packages/node/test/util.js                    |  5 ++-
 packages/node/test/waysToRun.spec.js          |  4 +-
 packages/perf/build.js                        |  4 +-
 packages/perf/endo.js                         | 22 +++++-----
 packages/perf/performTask.js                  |  4 +-
 packages/survey/src/downloadPackage.js        |  8 ++--
 packages/survey/src/execTest.js               | 10 ++---
 packages/survey/src/getTopPackages.js         |  4 +-
 packages/survey/src/index.js                  |  4 +-
 packages/survey/src/load.js                   |  2 +-
 packages/survey/src/parseForPolicy.js         |  4 +-
 packages/survey/src/prepareHook.js            |  4 +-
 packages/survey/src/util.js                   |  2 +-
 packages/tofu/test/findGlobals.spec.js        |  6 +--
 packages/tofu/test/inspectImports.spec.js     | 44 ++++++++++++-------
 packages/viz/bin/index.js                     |  6 +--
 packages/viz/src/graphs/utils/utils.js        |  9 ++--
 packages/viz/src/webpack.config.js            |  8 ++--
 packages/webpack/src/buildtime/emitSes.js     |  2 +-
 packages/webpack/src/buildtime/generator.js   |  2 +-
 packages/webpack/src/buildtime/wrapper.js     |  2 +-
 packages/webpack/src/plugin.js                |  2 +-
 packages/webpack/test/e2e-policy-gen.spec.js  |  2 +-
 packages/webpack/test/scaffold.js             |  6 +--
 47 files changed, 147 insertions(+), 136 deletions(-)

diff --git a/packages/aa/test/bench.js b/packages/aa/test/bench.js
index adefc4db9d..a989e98588 100644
--- a/packages/aa/test/bench.js
+++ b/packages/aa/test/bench.js
@@ -47,7 +47,7 @@ const recordMemorySpike = (frequency = 10) => {
 
 const history = (name, value) => {
   const fs = require('node:fs')
-  const { execSync } = require('child_process')
+  const { execSync } = require('node:child_process')
   const filePath = `.bench-${name}.log` // the intention is for the file to be gitignored and only referred locally
   let log = {}
   if (fs.existsSync(filePath)) {
diff --git a/packages/allow-scripts/src/index.js b/packages/allow-scripts/src/index.js
index 16fa16a0f4..db9968d425 100644
--- a/packages/allow-scripts/src/index.js
+++ b/packages/allow-scripts/src/index.js
@@ -1,7 +1,7 @@
 // @ts-check
 
-const { promises: fs } = require('fs')
-const path = require('path')
+const { promises: fs } = require('node:fs')
+const path = require('node:path')
 const npmRunScript = require('@npmcli/run-script')
 const normalizeBin = require('npm-normalize-package-bin')
 const { linkBinAbsolute, linkBinRelative } = require('./linker.js')
diff --git a/packages/allow-scripts/src/linker.js b/packages/allow-scripts/src/linker.js
index 665b43c6ae..9f26f5823e 100644
--- a/packages/allow-scripts/src/linker.js
+++ b/packages/allow-scripts/src/linker.js
@@ -7,7 +7,7 @@ const linkBin = isWindows
   ? require('bin-links/lib/shim-bin.js')
   : require('bin-links/lib/link-bin.js')
 
-const { dirname, resolve, relative } = require('path')
+const { dirname, resolve, relative } = require('node:path')
 
 /**
  * @param {LinkBinOpts} opts
diff --git a/packages/allow-scripts/src/setup.js b/packages/allow-scripts/src/setup.js
index 347c4492d3..ee01fa07c9 100755
--- a/packages/allow-scripts/src/setup.js
+++ b/packages/allow-scripts/src/setup.js
@@ -3,9 +3,9 @@ const {
   appendFileSync,
   readFileSync,
   writeFileSync,
-} = require('fs')
-const { spawnSync } = require('child_process')
-const path = require('path')
+} = require('node:fs')
+const { spawnSync } = require('node:child_process')
+const path = require('node:path')
 const { FEATURE } = require('./toggles')
 
 const NPM = {
diff --git a/packages/allow-scripts/src/whichbin.js b/packages/allow-scripts/src/whichbin.js
index 5d9ace1740..a6440cd3f6 100755
--- a/packages/allow-scripts/src/whichbin.js
+++ b/packages/allow-scripts/src/whichbin.js
@@ -2,7 +2,7 @@
 /* eslint-disable n/shebang */
 
 // @ts-check
-const path = require('path')
+const path = require('node:path')
 const { getOptionsForBin } = require('./index.js')
 const { FEATURE } = require('./toggles.js')
 
diff --git a/packages/browserify/src/createPackageDataStream.js b/packages/browserify/src/createPackageDataStream.js
index fa713b7060..cb23cfc736 100644
--- a/packages/browserify/src/createPackageDataStream.js
+++ b/packages/browserify/src/createPackageDataStream.js
@@ -1,4 +1,4 @@
-const { callbackify } = require('util')
+const { callbackify } = require('node:util')
 const through = require('through2').obj
 const { getPackageNameForModulePath } = require('@lavamoat/aa')
 
diff --git a/packages/browserify/src/index.js b/packages/browserify/src/index.js
index db802666fb..b265d5b57b 100644
--- a/packages/browserify/src/index.js
+++ b/packages/browserify/src/index.js
@@ -1,5 +1,5 @@
-const fs = require('fs')
-const path = require('path')
+const fs = require('node:fs')
+const path = require('node:path')
 const { getDefaultPaths } = require('lavamoat-core')
 const jsonStringify = require('json-stable-stringify')
 const { createModuleInspectorSpy } = require('./createModuleInspectorSpy.js')
diff --git a/packages/browserify/src/sesTransforms.js b/packages/browserify/src/sesTransforms.js
index 8412685317..2ed4c35b0f 100644
--- a/packages/browserify/src/sesTransforms.js
+++ b/packages/browserify/src/sesTransforms.js
@@ -1,4 +1,4 @@
-const path = require('path')
+const path = require('node:path')
 const { PassThrough } = require('readable-stream')
 const duplexify = require('duplexify')
 const concatStream = require('concat-stream')
diff --git a/packages/browserify/test/fixtures/secureBundling/lavamoat/node/policy.json b/packages/browserify/test/fixtures/secureBundling/lavamoat/node/policy.json
index 71eacd7b99..898c88b3d6 100644
--- a/packages/browserify/test/fixtures/secureBundling/lavamoat/node/policy.json
+++ b/packages/browserify/test/fixtures/secureBundling/lavamoat/node/policy.json
@@ -109,13 +109,13 @@
     },
     "@lavamoat/lavapack": {
       "builtin": {
-        "assert": true,
-        "buffer.Buffer.from": true,
-        "fs.promises.readFile": true,
-        "fs.promises.writeFile": true,
-        "fs.readFileSync": true,
-        "path.join": true,
-        "path.relative": true
+        "node:assert": true,
+        "node:buffer.Buffer.from": true,
+        "node:fs.promises.readFile": true,
+        "node:fs.promises.writeFile": true,
+        "node:fs.readFileSync": true,
+        "node:path.join": true,
+        "node:path.relative": true
       },
       "globals": {
         "__dirname": true,
@@ -1031,12 +1031,11 @@
     },
     "lavamoat-core": {
       "builtin": {
-        "events": true,
-        "fs.readFileSync": true,
+        "node:events": true,
         "node:fs.readFileSync": true,
         "node:fs/promises.writeFile": true,
-        "path.extname": true,
-        "path.join": true
+        "node:path.extname": true,
+        "node:path.join": true
       },
       "globals": {
         "__dirname": true,
diff --git a/packages/browserify/test/lavamoatNode.spec.js b/packages/browserify/test/lavamoatNode.spec.js
index 9895c51bd8..d7b9c0868c 100644
--- a/packages/browserify/test/lavamoatNode.spec.js
+++ b/packages/browserify/test/lavamoatNode.spec.js
@@ -1,6 +1,6 @@
 const test = require('ava')
-const { execSync } = require('child_process')
-const path = require('path')
+const { execSync } = require('node:child_process')
+const path = require('node:path')
 const { evalBundle } = require('./util')
 
 test('lavamoat-node compat - bundle works under lavamoat node', (t) => {
diff --git a/packages/browserify/test/policy.spec.js b/packages/browserify/test/policy.spec.js
index 2655b52e9e..babd6c193d 100644
--- a/packages/browserify/test/policy.spec.js
+++ b/packages/browserify/test/policy.spec.js
@@ -1,7 +1,7 @@
 /* eslint-disable ava/use-t-well */
 const test = require('ava')
-const fs = require('fs')
-const path = require('path')
+const fs = require('node:fs')
+const path = require('node:path')
 const {
   createScenarioFromScaffold,
   runAndTestScenario,
diff --git a/packages/browserify/test/util.js b/packages/browserify/test/util.js
index d63ea77a8e..56620d9050 100644
--- a/packages/browserify/test/util.js
+++ b/packages/browserify/test/util.js
@@ -1,8 +1,8 @@
-const { runInNewContext } = require('vm')
+const { runInNewContext } = require('node:vm')
 const browserify = require('browserify')
 const pify = require('pify')
-const { promises: fs } = require('fs')
-const path = require('path')
+const { promises: fs } = require('node:fs')
+const path = require('node:path')
 const watchify = require('watchify')
 const lavamoatPlugin = require('../src/index')
 const { verifySourceMaps } = require('./sourcemaps')
@@ -12,10 +12,10 @@ const {
   evaluateWithSourceUrl,
   createHookedConsole,
 } = require('lavamoat-core/test/util.js')
-const util = require('util')
+const util = require('node:util')
 const tmp = require('tmp-promise')
-const { spawnSync } = require('child_process')
-const execFile = util.promisify(require('child_process').execFile)
+const { spawnSync } = require('node:child_process')
+const execFile = util.promisify(require('node:child_process').execFile)
 
 const WORKSPACE_ROOT = path.resolve(__dirname, '..', '..', '..')
 
diff --git a/packages/core/src/generateKernel.js b/packages/core/src/generateKernel.js
index d32902266c..303f7baf00 100644
--- a/packages/core/src/generateKernel.js
+++ b/packages/core/src/generateKernel.js
@@ -4,8 +4,8 @@
 // The prelude is defined in the `preludeTemplate` file, and here we inject the dynamic components,
 // such as the upgradeable SES and app specific config.
 
-const fs = require('fs')
-const path = require('path')
+const fs = require('node:fs')
+const path = require('node:path')
 const kernelTemplate = fs.readFileSync(
   path.join(__dirname, '/kernelTemplate.js'),
   'utf-8'
diff --git a/packages/core/src/generatePolicy.js b/packages/core/src/generatePolicy.js
index 492e8d3d57..c489ffcab5 100644
--- a/packages/core/src/generatePolicy.js
+++ b/packages/core/src/generatePolicy.js
@@ -1,7 +1,7 @@
 // @ts-check
 
-const EventEmitter = require('events')
-const path = require('path')
+const EventEmitter = require('node:events')
+const path = require('node:path')
 const jsonStringify = require('json-stable-stringify')
 const {
   parse,
diff --git a/packages/core/test/builtin.spec.js b/packages/core/test/builtin.spec.js
index 2e7bb0af26..73445f2412 100644
--- a/packages/core/test/builtin.spec.js
+++ b/packages/core/test/builtin.spec.js
@@ -68,7 +68,7 @@ test('builtin - access via paths', async (t) => {
 test('builtin - paths soft-bindings preserve "this" but allow override', async (t) => {
   const scenario = createScenarioFromScaffold({
     defineOne: () => {
-      const { Buffer } = require('buffer')
+      const { Buffer } = require('node:buffer')
       const two = require('two')
       module.exports = {
         overrideCheck: two.overrideCheck(Buffer.from([1, 2, 3])),
@@ -78,7 +78,7 @@ test('builtin - paths soft-bindings preserve "this" but allow override', async (
     },
 
     defineTwo: () => {
-      const { Buffer } = require('buffer')
+      const { Buffer } = require('node:buffer')
       const thisChecker = require('thisChecker')
       const { SomeClass } = require('someClass')
       // this test ensures "Buffer.prototype.slice" is copied in a way that allows "this" to be overridden
@@ -101,13 +101,13 @@ test('builtin - paths soft-bindings preserve "this" but allow override', async (
       resources: {
         one: {
           builtin: {
-            'buffer.Buffer.from': true,
+            'node:buffer.Buffer.from': true,
           },
         },
         two: {
           builtin: {
             // these paths are carefully constructed to try and split the fn from its parent
-            'buffer.Buffer.prototype.slice': true,
+            'node:buffer.Buffer.prototype.slice': true,
             'thisChecker.check': true,
             'someClass.SomeClass': true,
           },
@@ -120,7 +120,7 @@ test('builtin - paths soft-bindings preserve "this" but allow override', async (
       classCheck: true,
     },
     builtin: {
-      buffer: require('buffer'),
+      'node:buffer': require('node:buffer'),
       thisChecker: (() => {
         const parent = {}
         parent.check = function () {
diff --git a/packages/lavapack/src/builder-runtime.js b/packages/lavapack/src/builder-runtime.js
index ffd2f46859..8a49c9406b 100644
--- a/packages/lavapack/src/builder-runtime.js
+++ b/packages/lavapack/src/builder-runtime.js
@@ -1,7 +1,7 @@
-const { join: pathJoin } = require('path')
+const { join: pathJoin } = require('node:path')
 const {
   promises: { readFile, writeFile },
-} = require('fs')
+} = require('node:fs')
 const { generateKernel, makeInitStatsHook } = require('lavamoat-core')
 const {
   getStrictScopeTerminatorShimSrc,
diff --git a/packages/lavapack/src/pack.js b/packages/lavapack/src/pack.js
index 265f87d085..41a7bb93cc 100644
--- a/packages/lavapack/src/pack.js
+++ b/packages/lavapack/src/pack.js
@@ -9,14 +9,14 @@
 // - cleanup: var -> const/let
 // - cleanup/refactor
 
-const fs = require('fs')
-const path = require('path')
-const assert = require('assert')
+const fs = require('node:fs')
+const path = require('node:path')
+const assert = require('node:assert')
 const JSONStream = require('JSONStream')
 const through = require('through2')
 const umd = require('umd')
 // eslint-disable-next-line n/prefer-global/buffer
-const { Buffer } = require('buffer')
+const { Buffer } = require('node:buffer')
 const combineSourceMap = require('combine-source-map')
 const convertSourceMap = require('convert-source-map')
 const jsonStringify = require('json-stable-stringify')
diff --git a/packages/lavapack/test/index.spec.js b/packages/lavapack/test/index.spec.js
index c1ecb34bd9..e328821103 100644
--- a/packages/lavapack/test/index.spec.js
+++ b/packages/lavapack/test/index.spec.js
@@ -1,4 +1,4 @@
-const fs = require('fs')
+const fs = require('node:fs')
 const test = require('ava')
 const { pipe, from, concat } = require('mississippi')
 const { SourceMapConsumer } = require('source-map')
diff --git a/packages/node/src/freshRealmCompartment.js b/packages/node/src/freshRealmCompartment.js
index 5f85956c08..5087230efd 100644
--- a/packages/node/src/freshRealmCompartment.js
+++ b/packages/node/src/freshRealmCompartment.js
@@ -1,4 +1,4 @@
-const vm = require('vm')
+const vm = require('node:vm')
 const { getSesShimSrc } = require('lavamoat-core/src/generateKernel')
 
 module.exports = { createFreshRealmCompartment }
diff --git a/packages/node/src/index.js b/packages/node/src/index.js
index 460d5b52b9..eebec1a679 100755
--- a/packages/node/src/index.js
+++ b/packages/node/src/index.js
@@ -1,7 +1,7 @@
 /* eslint-disable no-eval */
 
-const path = require('path')
-const fs = require('fs')
+const path = require('node:path')
+const fs = require('node:fs')
 const jsonStringify = require('json-stable-stringify')
 const { loadPolicy, loadPolicyAndApplyOverrides } = require('lavamoat-core')
 const { loadCanonicalNameMap } = require('@lavamoat/aa')
diff --git a/packages/node/src/kernel.js b/packages/node/src/kernel.js
index 69f8aa49ce..183eb176d3 100644
--- a/packages/node/src/kernel.js
+++ b/packages/node/src/kernel.js
@@ -1,6 +1,6 @@
 /* eslint no-eval: 0 */
-const fs = require('fs')
-const path = require('path')
+const fs = require('node:fs')
+const path = require('node:path')
 const resolve = require('resolve')
 const { sanitize } = require('htmlescape')
 const {
diff --git a/packages/node/src/parseForPolicy.js b/packages/node/src/parseForPolicy.js
index 576f8ef0f9..6eaa796bda 100644
--- a/packages/node/src/parseForPolicy.js
+++ b/packages/node/src/parseForPolicy.js
@@ -1,6 +1,6 @@
-const path = require('path')
-const { promises: fs } = require('fs')
-const { builtinModules } = require('module')
+const path = require('node:path')
+const { promises: fs } = require('node:fs')
+const { builtinModules } = require('node:module')
 const resolve = require('resolve')
 const bindings = require('bindings')
 const gypBuild = require('node-gyp-build')
diff --git a/packages/node/src/run-command.js b/packages/node/src/run-command.js
index c29987d430..ca9df51e7b 100755
--- a/packages/node/src/run-command.js
+++ b/packages/node/src/run-command.js
@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 /* eslint-disable no-eval */
 
-const path = require('path')
-const fs = require('fs')
+const path = require('node:path')
+const fs = require('node:fs')
 const yargs = require('yargs')
 const yargsFlags = require('./yargsFlags')
 const { runLava } = require('./index')
diff --git a/packages/node/test/util.js b/packages/node/test/util.js
index 26e4e405e0..062d600f61 100644
--- a/packages/node/test/util.js
+++ b/packages/node/test/util.js
@@ -1,7 +1,7 @@
 // @ts-check
 
-const util = require('util')
-const execFile = util.promisify(require('child_process').execFile)
+const util = require('node:util')
+const execFile = util.promisify(require('node:child_process').execFile)
 const { prepareScenarioOnDisk } = require('lavamoat-core/test/util.js')
 module.exports = {
   runLavamoat,
@@ -12,6 +12,7 @@ module.exports = {
  * Add one or more CLI options to an array of args
  *
  * Mutates `args`
+ *
  * @param {string[]} args - Array of args
  * @param {string} key - Option name
  * @param {any} value - Value; if array, `key` will be set multiple times
diff --git a/packages/node/test/waysToRun.spec.js b/packages/node/test/waysToRun.spec.js
index c631740abe..b0e0c2159a 100644
--- a/packages/node/test/waysToRun.spec.js
+++ b/packages/node/test/waysToRun.spec.js
@@ -1,6 +1,6 @@
 const test = require('ava')
-const util = require('util')
-const execFile = util.promisify(require('child_process').execFile)
+const util = require('node:util')
+const execFile = util.promisify(require('node:child_process').execFile)
 
 const { runLava } = require('../src/index')
 
diff --git a/packages/perf/build.js b/packages/perf/build.js
index 72caaf62a8..25be69a06a 100644
--- a/packages/perf/build.js
+++ b/packages/perf/build.js
@@ -1,7 +1,7 @@
-const fs = require('fs')
+const fs = require('node:fs')
 const browserify = require('browserify')
 const lavamoatPlugin = require('lavamoat-browserify')
-const { pipeline } = require('stream')
+const { pipeline } = require('node:stream')
 
 // "autogen": "--plugin [ lavamoat-browserify --writeAutoPolicy --policy ./lavamoat-policy.json ] > /dev/null",
 // "default": "--plugin [ lavamoat-browserify --policy ./lavamoat-policy.json ] > bundle.js",
diff --git a/packages/perf/endo.js b/packages/perf/endo.js
index e10c7f78e2..4654d88335 100644
--- a/packages/perf/endo.js
+++ b/packages/perf/endo.js
@@ -1,6 +1,6 @@
-const fs = require('fs')
-const url = require('url')
-const crypto = require('crypto')
+const fs = require('node:fs')
+const url = require('node:url')
+const crypto = require('node:crypto')
 
 require('ses')
 lockdown()
@@ -48,14 +48,14 @@ async function main() {
     transforms
 
   const modules = {
-    stream: await addToCompartment('stream', require('stream')),
-    events: await addToCompartment('events', require('events')),
-    buffer: await addToCompartment('buffer', require('buffer')),
-    util: await addToCompartment('util', require('util')),
-    crypto: await addToCompartment('crypto', require('crypto')),
-    assert: await addToCompartment('assert', require('assert')),
-    path: await addToCompartment('path', require('path')),
-    fs: await addToCompartment('fs', require('fs')),
+    stream: await addToCompartment('stream', require('node:stream')),
+    events: await addToCompartment('events', require('node:events')),
+    buffer: await addToCompartment('buffer', require('node:buffer')),
+    util: await addToCompartment('util', require('node:util')),
+    crypto: await addToCompartment('crypto', require('node:crypto')),
+    assert: await addToCompartment('assert', require('node:assert')),
+    path: await addToCompartment('path', require('node:path')),
+    fs: await addToCompartment('fs', require('node:fs')),
   }
 
   const readPowers = makeReadPowers({ fs, url, crypto })
diff --git a/packages/perf/performTask.js b/packages/perf/performTask.js
index ef3a038d4f..d3b8b15bb8 100644
--- a/packages/perf/performTask.js
+++ b/packages/perf/performTask.js
@@ -1,5 +1,5 @@
-const util = require('util')
-const exec = util.promisify(require('child_process').exec)
+const util = require('node:util')
+const exec = util.promisify(require('node:child_process').exec)
 
 module.exports = { performTest }
 
diff --git a/packages/survey/src/downloadPackage.js b/packages/survey/src/downloadPackage.js
index 133e9ccef3..75f701632a 100644
--- a/packages/survey/src/downloadPackage.js
+++ b/packages/survey/src/downloadPackage.js
@@ -1,7 +1,7 @@
-const util = require('util')
-const execFile = util.promisify(require('child_process').execFile)
-const { promises: fs } = require('fs')
-const { resolve, join } = require('path')
+const util = require('node:util')
+const execFile = util.promisify(require('node:child_process').execFile)
+const { promises: fs } = require('node:fs')
+const { resolve, join } = require('node:path')
 
 module.exports = {
   downloadPackage,
diff --git a/packages/survey/src/execTest.js b/packages/survey/src/execTest.js
index e29564829c..1b59e0dcb5 100644
--- a/packages/survey/src/execTest.js
+++ b/packages/survey/src/execTest.js
@@ -1,8 +1,8 @@
-const { promisify } = require('util')
-const path = require('path')
-const os = require('os')
-const { promises: fs } = require('fs')
-const { spawn, exec: execCb } = require('child_process')
+const { promisify } = require('node:util')
+const path = require('node:path')
+const os = require('node:os')
+const { promises: fs } = require('node:fs')
+const { spawn, exec: execCb } = require('node:child_process')
 
 const exec = promisify(execCb)
 const makeTempDir = async () => {
diff --git a/packages/survey/src/getTopPackages.js b/packages/survey/src/getTopPackages.js
index aaade60768..e5474aa8a0 100644
--- a/packages/survey/src/getTopPackages.js
+++ b/packages/survey/src/getTopPackages.js
@@ -1,5 +1,5 @@
-const path = require('path')
-const { promises: fs } = require('fs')
+const path = require('node:path')
+const { promises: fs } = require('node:fs')
 const fetch = require('node-fetch')
 const cheerio = require('cheerio')
 const pLimit = require('p-limit')
diff --git a/packages/survey/src/index.js b/packages/survey/src/index.js
index 26c5acb356..a05bde76f0 100644
--- a/packages/survey/src/index.js
+++ b/packages/survey/src/index.js
@@ -1,5 +1,5 @@
-const { promises: fs } = require('fs')
-const path = require('path')
+const { promises: fs } = require('node:fs')
+const path = require('node:path')
 const pLimit = require('p-limit')
 const { makeResolveHook } = require('lavamoat/src/parseForPolicy')
 const { loadPackage } = require('./load.js')
diff --git a/packages/survey/src/load.js b/packages/survey/src/load.js
index 7d9a401b91..07fe0f4b36 100644
--- a/packages/survey/src/load.js
+++ b/packages/survey/src/load.js
@@ -1,4 +1,4 @@
-const { resolve } = require('path')
+const { resolve } = require('node:path')
 const { downloadPackage } = require('./downloadPackage.js')
 const { fileExists } = require('./util.js')
 
diff --git a/packages/survey/src/parseForPolicy.js b/packages/survey/src/parseForPolicy.js
index 60be184580..d637277d7b 100644
--- a/packages/survey/src/parseForPolicy.js
+++ b/packages/survey/src/parseForPolicy.js
@@ -1,9 +1,9 @@
-const path = require('path')
+const path = require('node:path')
 const {
   makeResolveHook,
   makeImportHook,
 } = require('lavamoat/src/parseForPolicy')
-const { builtinModules: builtinPackages } = require('module')
+const { builtinModules: builtinPackages } = require('node:module')
 const { inspectSesCompat, codeSampleFromAstNode } = require('lavamoat-tofu')
 const { walk } = require('lavamoat-core/src/walk')
 
diff --git a/packages/survey/src/prepareHook.js b/packages/survey/src/prepareHook.js
index bdacd77388..04d98af999 100644
--- a/packages/survey/src/prepareHook.js
+++ b/packages/survey/src/prepareHook.js
@@ -4,8 +4,8 @@
 // environment PATH.
 // this has been borrowed and modified from https://github.com/agoric/ses-shim
 
-const fs = require('fs')
-const path = require('path')
+const fs = require('node:fs')
+const path = require('node:path')
 
 const node = process.env.NVM_BIN
   ? `${process.env.NVM_BIN}/node`
diff --git a/packages/survey/src/util.js b/packages/survey/src/util.js
index 947a3b340b..020211505a 100644
--- a/packages/survey/src/util.js
+++ b/packages/survey/src/util.js
@@ -1,4 +1,4 @@
-const { promises: fs } = require('fs')
+const { promises: fs } = require('node:fs')
 
 module.exports = { fileExists }
 
diff --git a/packages/tofu/test/findGlobals.spec.js b/packages/tofu/test/findGlobals.spec.js
index c4dca20d89..71d616568c 100644
--- a/packages/tofu/test/findGlobals.spec.js
+++ b/packages/tofu/test/findGlobals.spec.js
@@ -1,8 +1,8 @@
 'use strict'
 
-const fs = require('fs')
-const path = require('path')
-const assert = require('assert')
+const fs = require('node:fs')
+const path = require('node:path')
+const assert = require('node:assert')
 const test = require('ava')
 const { parse } = require('../src/index')
 const { findGlobals } = require('../src/findGlobals')
diff --git a/packages/tofu/test/inspectImports.spec.js b/packages/tofu/test/inspectImports.spec.js
index 3b0e8ff8aa..888238caac 100644
--- a/packages/tofu/test/inspectImports.spec.js
+++ b/packages/tofu/test/inspectImports.spec.js
@@ -6,11 +6,11 @@ testInspect(
   'cjs - basic',
   {},
   () => {
-    const fs = require('fs')
+    const fs = require('node:fs')
     module.exports = fs
   },
   {
-    cjsImports: ['fs'],
+    cjsImports: ['node:fs'],
   }
 )
 
@@ -19,7 +19,7 @@ testInspect(
   {},
   () => {
     const require = () => {}
-    require('fs')
+    require('node:fs')
   },
   {
     cjsImports: [],
@@ -30,10 +30,10 @@ testInspect(
   'cjs - include even if require result not stored in variable',
   {},
   () => {
-    require('fs').readFileSync
+    require('node:fs').readFileSync
   },
   {
-    cjsImports: ['fs.readFileSync'],
+    cjsImports: ['node:fs.readFileSync'],
   }
 )
 
@@ -41,7 +41,19 @@ testInspect(
   'cjs - include even if declared var is unused',
   {},
   () => {
-    const rfs = require('fs').readFileSync
+    const rfs = require('node:fs').readFileSync
+  },
+  {
+    cjsImports: ['node:fs.readFileSync'],
+  }
+)
+
+testInspect(
+  'cjs - include if no prefix for builtin provided',
+  {},
+  () => {
+    // eslint-disable-next-line node-import/prefer-node-protocol
+    require('fs').readFileSync
   },
   {
     cjsImports: ['fs.readFileSync'],
@@ -59,12 +71,12 @@ testInspect(
   'cjs - basic destructure',
   {},
   () => {
-    const { readFileSync, createReadStream } = require('fs')
+    const { readFileSync, createReadStream } = require('node:fs')
     readFileSync()
     createReadStream()
   },
   {
-    cjsImports: ['fs.readFileSync', 'fs.createReadStream'],
+    cjsImports: ['node:fs.readFileSync', 'node:fs.createReadStream'],
   }
 )
 
@@ -72,11 +84,11 @@ testInspect(
   'cjs - basic member',
   {},
   () => {
-    const rfs = require('fs').readFileSync
+    const rfs = require('node:fs').readFileSync
     rfs()
   },
   {
-    cjsImports: ['fs.readFileSync'],
+    cjsImports: ['node:fs.readFileSync'],
   }
 )
 
@@ -88,11 +100,11 @@ testInspect(
       constructor: {
         name: [bigEff],
       },
-    } = require('fs').readFileSync
+    } = require('node:fs').readFileSync
     bigEff()
   },
   {
-    cjsImports: ['fs.readFileSync.constructor.name.0'],
+    cjsImports: ['node:fs.readFileSync.constructor.name.0'],
   }
 )
 
@@ -100,12 +112,12 @@ testInspect(
   'cjs - usage basic',
   {},
   () => {
-    const fs = require('fs')
+    const fs = require('node:fs')
     fs.readFileSync()
     fs.createReadStream()
   },
   {
-    cjsImports: ['fs.readFileSync', 'fs.createReadStream'],
+    cjsImports: ['node:fs.readFileSync', 'node:fs.createReadStream'],
   }
 )
 
@@ -114,11 +126,11 @@ testInspect(
   {},
   () => {
     // eslint-disable-next-line n/prefer-global/process
-    const { sourceUrl: url } = require('process').release
+    const { sourceUrl: url } = require('node:process').release
     url.includes('v12')
   },
   {
-    cjsImports: ['process.release.sourceUrl.includes'],
+    cjsImports: ['node:process.release.sourceUrl.includes'],
   }
 )
 
diff --git a/packages/viz/bin/index.js b/packages/viz/bin/index.js
index 0cf8e2f180..c870dea363 100755
--- a/packages/viz/bin/index.js
+++ b/packages/viz/bin/index.js
@@ -2,9 +2,9 @@
 /* eslint-env node */
 /* eslint-disable import/unambiguous */
 
-const { promises: fs } = require('fs')
-const path = require('path')
-const http = require('http')
+const { promises: fs } = require('node:fs')
+const path = require('node:path')
+const http = require('node:http')
 const yargs = require('yargs')
 const { ncp } = require('ncp')
 const pify = require('pify')
diff --git a/packages/viz/src/graphs/utils/utils.js b/packages/viz/src/graphs/utils/utils.js
index 6aa0d48b90..5ea8c03bbb 100644
--- a/packages/viz/src/graphs/utils/utils.js
+++ b/packages/viz/src/graphs/utils/utils.js
@@ -1,5 +1,6 @@
 /* eslint-disable no-shadow */
 
+// eslint-disable-next-line node-import/prefer-node-protocol
 const path = require('path')
 
 export const nodeEnvConfig = {
@@ -356,14 +357,14 @@ function sortByKey(key, reverse = false) {
 }
 
 export {
-  parseConfigDebugForPackages,
   createGraph,
+  fullModuleNameFromPath,
+  getColorForRank,
   getDangerRankForModule,
   getDangerRankForPackage,
-  getColorForRank,
-  fullModuleNameFromPath,
+  getEnvConfigForPolicyName,
   getLineNumbersForGlobals,
+  parseConfigDebugForPackages,
   sortByDangerRank,
-  getEnvConfigForPolicyName,
   sortIntelligently,
 }
diff --git a/packages/viz/src/webpack.config.js b/packages/viz/src/webpack.config.js
index 5dec065d27..17ce1d1430 100644
--- a/packages/viz/src/webpack.config.js
+++ b/packages/viz/src/webpack.config.js
@@ -1,6 +1,6 @@
 /* eslint-env node */
 /* eslint-disable require-unicode-regexp */
-const path = require('path')
+const path = require('node:path')
 const HtmlWebPackPlugin = require('html-webpack-plugin')
 const CopyPlugin = require('copy-webpack-plugin')
 
@@ -9,7 +9,7 @@ const distPath = path.join(__dirname, '../dist')
 // TODO: temporary workaround for making webpack 4 work across Node.js versions
 // Remove once project upgraded to webpack 5
 // https://stackoverflow.com/questions/69394632/webpack-build-failing-with-err-ossl-evp-unsupported/69691525#69691525
-const crypto = require('crypto')
+const crypto = require('node:crypto')
 const crypto_orig_createHash = crypto.createHash
 crypto.createHash = (algorithm) =>
   crypto_orig_createHash(algorithm === 'md4' ? 'sha256' : algorithm)
@@ -46,9 +46,7 @@ module.exports = {
       template: path.join(__dirname, '../src/templates/index.html.template'),
     }),
     new CopyPlugin({
-      patterns: [
-        { from: './src/assets/', to: `${distPath}/assets/` },
-      ],
+      patterns: [{ from: './src/assets/', to: `${distPath}/assets/` }],
     }),
   ],
   resolve: {
diff --git a/packages/webpack/src/buildtime/emitSes.js b/packages/webpack/src/buildtime/emitSes.js
index 52f18640cc..43e0190798 100644
--- a/packages/webpack/src/buildtime/emitSes.js
+++ b/packages/webpack/src/buildtime/emitSes.js
@@ -1,4 +1,4 @@
-const { readFileSync } = require('fs')
+const { readFileSync } = require('node:fs')
 const {
   sources: { RawSource },
 } = require('webpack')
diff --git a/packages/webpack/src/buildtime/generator.js b/packages/webpack/src/buildtime/generator.js
index d1e39d42ea..c8a218bd39 100644
--- a/packages/webpack/src/buildtime/generator.js
+++ b/packages/webpack/src/buildtime/generator.js
@@ -2,7 +2,7 @@
 /** @typedef {import('webpack').NormalModule} NormalModule */
 /** @typedef {import('webpack').sources.Source} Source */
 
-const path = require('path')
+const path = require('node:path')
 const {
   sources: { ConcatSource },
 } = require('webpack')
diff --git a/packages/webpack/src/buildtime/wrapper.js b/packages/webpack/src/buildtime/wrapper.js
index 295733ba2f..b9e5cf3db0 100644
--- a/packages/webpack/src/buildtime/wrapper.js
+++ b/packages/webpack/src/buildtime/wrapper.js
@@ -1,7 +1,7 @@
 // @ts-expect-error - missing types
 const { applySourceTransforms } = require('lavamoat-core')
 const diag = require('./diagnostics')
-const fs = require('fs')
+const fs = require('node:fs')
 const q = JSON.stringify
 
 /**
diff --git a/packages/webpack/src/plugin.js b/packages/webpack/src/plugin.js
index 5d709af670..40beea0a62 100644
--- a/packages/webpack/src/plugin.js
+++ b/packages/webpack/src/plugin.js
@@ -1,4 +1,4 @@
-const path = require('path')
+const path = require('node:path')
 const { WebpackError, RuntimeModule } = require('webpack')
 const { Compilation } = require('webpack')
 const browserResolve = require('browser-resolve')
diff --git a/packages/webpack/test/e2e-policy-gen.spec.js b/packages/webpack/test/e2e-policy-gen.spec.js
index fffda7d05f..93be77855e 100644
--- a/packages/webpack/test/e2e-policy-gen.spec.js
+++ b/packages/webpack/test/e2e-policy-gen.spec.js
@@ -1,7 +1,7 @@
 const test = require('ava')
 const { scaffold, runScriptWithSES } = require('./scaffold.js')
 const { makeConfig } = require('./fixtures/main/webpack.config.js')
-const path = require('path')
+const path = require('node:path')
 
 test.before(async (t) => {
   const webpackConfig = makeConfig({
diff --git a/packages/webpack/test/scaffold.js b/packages/webpack/test/scaffold.js
index dc93c51c6e..21ae12eb9d 100644
--- a/packages/webpack/test/scaffold.js
+++ b/packages/webpack/test/scaffold.js
@@ -1,9 +1,9 @@
-const path = require('path')
+const path = require('node:path')
 const webpack = require('webpack')
 const memfs = require('memfs')
 const { toSnapshotSync } = require('memfs/lib/snapshot')
-const { createContext, Script, runInNewContext } = require('vm')
-const { readFileSync } = require('fs')
+const { createContext, Script, runInNewContext } = require('node:vm')
+const { readFileSync } = require('node:fs')
 
 /**
  * Run a webpack build and return the output