• Rollup Plugin Name: commonjs (I guess?)
• Rollup Plugin Version: 22.0.2
• Rollup Version: 2.78.0
• Operating System (or Browser): windows 11
• Node Version: 16.16.0
• Link to reproduction: https://replit.com/@simonbuchan/rollup-plugin-commonjs-treeshake#output/bundle.js

Expected Behavior

Due to "sideEffects": false, the content of evil.js should not be included in the bundle:

Object.prototype.evil = "don't expect this to be here";

Actual Behavior

When commonjs() is included in plugins, the side effects are included, despite there being no require / exports or other required transformations.

Additional Information

AFAICT, this is essentially what breaks the majority of tree-shaking out there, lodash-es, @aws-sdk, etc...

This seems to be due to the injected commonjs--resolve plugin, replacing commonjs() with: { ...commonjs(), options: undefined }, which prevents this injection causes the issue to go away.

Injecting logging after said injected plugins' resolveId shows it returning each module twice, first with moduleSideEffects set to true, then set to false. Not sure why the same plugin resolveId is being called twice, with the same options even.

The upshot seems to be that the moduleSideEffects value from, e.g. @rollup/plugin-node-resolve is getting dropped by commonjs.