Consider outputting ESM

[acidoxee]

Checklist

• I have looked into the Readme and Examples, and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

The current package is CJS-only. The package itself isn't that heavy, but it being in CJS has the downside of also pulling all transitive dependencies as CJS, despite some of them providing ESM entrypoints (including the heaviest dependency, jose).

Describe the ideal solution

It would be great if jwks-rsa were a dual CJS/ESM package, with "real" entrypoints for each (not just a thin wrapper of the one around the other). ESM consumers would be able to leverage proper tree-shaking of not only jwks-rsa, but also of its transitive dependencies that provide ESM entrypoints like jose, which are incredibly heavy in CJS and would be way lighter in ESM.

Alternatives and current workarounds

No response

Additional context

No response

[adamjmcgrath]

Hi @acidoxee - thanks for raising this

We don't have any plans to convert this package to dual CJS/ESM, but I'll leave this open as an enhancement in case anyone wants to raise a PR

[acidoxee]

Hey @adamjmcgrath, I've just submitted #380 which I believe addresses a good portion of the migration towards dual CJS/ESM. There's still some work to do to fix existing (but until then, masked/missed) typing errors, fix examples and update the README and changelog to advertise for the potential breaking change.

I'll let you check the PR itself, and if you have time to review it I'd be happy to try and finish it with you or other maintainers, since it would progress quicker with your inputs and help 🙏