fix: revert ESM dynamic import, require less >= 4.6.3

[lemachadoh]

Problem

PR #578 replaced require('less') with await import('less').default to work around an ESM/CJS interop issue introduced in less@4.6.x. This was a breaking change shipped as a patch: any CJS consumer that calls the loader in a Jest environment without --experimental-vm-modules breaks with:

SyntaxError: Cannot use import statement outside a module

Tracked in: #584

Root Cause Fix in less@4.6.3

less@4.6.3 resolves the root cause by shipping a pre-built CJS bundle at dist/less-node.cjs and pointing the "require" exports condition to it:

"exports": {
  "require": "./dist/less-node.cjs",
  "import": "./index.js"
}

No more Proxy, no more ESM-in-CJS problem. less-loader can now safely use require() again.

Changes

• Revert getLessImplementation from async + await import() back to sync require()
• Restore test:only script to cross-env NODE_ENV=test jest (remove --experimental-vm-modules)
• Remove exclude: ["transform-dynamic-import"] from babel config (no longer needed)
• Update peer dependency: less: "^3.5.0 || ^4.0.0" → "^3.5.0 || ^4.6.3" (4.x users must be on >= 4.6.3)
• Update dev dependency: less → ^4.6.3
• Preserve sourceMap improvements from fix: compatibility with ECMA modules less version #578 (sourceMapBasepath: "", disableSourcemapAnnotation: true, normalizeSourceMap) — these are correct and independent of the ESM issue
• Update tests to match less@4.6.3 source map path behavior

Testing

All 110 tests pass.

Use of AI

yes

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: lemachadoh / name: lemachadoh (af246be)

[alexander-akait]

Please accept CLA

[alexander-akait]

Remove this change, it is a breaking change

[lemachadoh]

I understand the concern, but #578 already introduced an undeclared breaking change. It shipped as a patch (12.3.1 -> 12.3.2) but broke any CJS consumer using Jest without --experimental-vm-modules. That's what this PR is fixing.

The peer dep update is necessary because less@4.0.0–4.6.2 don't ship a real CJS bundle. require('less') on those versions returns a Proxy that breaks at runtime. Without the constraint, reverting to require() would silently break users on less@4.6.0–4.6.2.

Would it make sense to release this as a major (13.0.0) to properly declare the breaking change? That would acknowledge that 12.3.2 was a breaking patch and restore CJS compatibility with the correct constraint.

[alexander-akait]

We will break developers with old version of less, we should not touch this field at all

[alexander-akait]

They publish this fix as a patch, so we should do the same, because it is a bug on their side

[alexander-akait]

Also please accept CLA

[lemachadoh]

Can you wait? I'm trying to accept it. For some reason it was logged with another account and not this one.

[alexander-akait]

@lemachadoh because your email in commits is not the same as you accept in CLA, change it

[alexander-akait]

This is due you are using AI, by default they generate no-reply email, not your

[lemachadoh]

hey @alexander-akait everything seems to be fine with the CLA