Import errors with jose in @knocklabs/node ESM builds (jose version conflict)

TL;DR: if @knocklabs/node breaks token signing in ESM builds because its vendored jose (capped at 5.2.0) clashes with your own jose (e.g. 5.9.6 for edge-runtime JWKS caching), upgrade to the @knocklabs/node 1.x release line. 1.x dropped the jose dependency entirely, which removes the conflict.

Steps

1. Upgrade the SDK:

npm install @knocklabs/node@^1.0.0

Expected: no jose in the SDK's own dependencies.

2. Rebuild your ESM bundle.

   Expected: no more import errors around jose. Success check: token signing works in the ESM build the way it already did in CommonJS.

3. On edge runtimes, import the signer explicitly with the latest version:

import { signUserToken } from '@knocklabs/node/lib/tokenSigner'

When to use this

• You use jose directly (e.g. 5.9.6 for stable edge-runtime JWKS caching) and @knocklabs/node pulls its own older jose.
• ESM-mode bundlers break on the SDK's rewritten require("jose") import while your own jose usage is fine.

When NOT to use this

• You build in CommonJS, where the conflict does not bite.
• Your jose errors have nothing to do with the Knock SDK.

Compatibility

• @knocklabs/node 1.x (jose dependency dropped). Note: dropping jose initially broke edge runtimes; that was fixed separately, so use the latest 1.x, not the first 1.0 cut.

Variant phrasings

• "knock node ESM jose import error"
• "@knocklabs/node token signing fails ESM build"
• "knock SDK jose version conflict"

Root cause

Knock's build rewrites the import to const jose_1 = require("jose"), which ESM-mode bundlers interpret as a default import, breaking token signing in ESM builds. The version cap at 5.2.0 made the conflict unavoidable until the dependency was dropped.

Edge cases

• If you are pinned below 1.x for other reasons, there is no clean fix; the dependency drop only exists on the 1.x line.

Someone asked: An app uses jose 5.9.6 directly (for stable edge-runtime JWKS caching) while @knocklabs/node caps its own jose dependency at 5.2.0. Knock's build rewrites the import to const jose_1 = require("jose"), which ESM-mode bundlers interpret as a default import, breaking token signing in ESM builds. The version conflict makes the SDK's token signing fail in ESM bundles even though the app's own jose usage is fine. The verified answer: The jose version conflict was resolved when @knocklabs/node 1.x dropped the jose dependency entirely. Upgrade to the 1.x release line to remove the conflict. Note: dropping jose initially broke edge runtimes, which was fixed separately; on edge runtimes import the signer explicitly as import { signUserToken } from '@knocklabs/node/lib/tokenSigner' with the latest version. Full thread: https://vectle.com/threads/thrfdzuLrC13RZFRh27CCp0g