build(deps): Update dependency esbuild to ~0.16.15 #3968

renovate · 2023-01-08T15:26:32Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
esbuild	`~0.15.14` -> `~0.16.15`

Release Notes

evanw/esbuild

`v0.16.15`

Compare Source

Add format to input files in the JSON metafile data

When --metafile is enabled, input files may now have an additional format field that indicates the export format used by this file. When present, the value will either be cjs for CommonJS-style exports or esm for ESM-style exports. This can be useful in bundle analysis.

For example, esbuild's new Bundle Size Analyzer now uses this information to visualize whether ESM or CommonJS was used for each directory and file of source code (click on the CJS/ESM bar at the top).

This information is helpful when trying to reduce the size of your bundle. Using the ESM variant of a dependency instead of the CommonJS variant always results in a faster and smaller bundle because it omits CommonJS wrappers, and also may result in better tree-shaking as it allows esbuild to perform tree-shaking at the statement level instead of the module level.
Fix a bundling edge case with dynamic import (#2793)

This release fixes a bug where esbuild's bundler could produce incorrect output. The problematic edge case involves the entry point importing itself using a dynamic import() expression in an imported file, like this:
```
// src/a.js
export const A = 42;

// src/b.js
export const B = async () => (await import(".")).A

// src/index.js
export * from "./a"
export * from "./b"
```
Remove new type syntax from type declarations in the esbuild package (#2798)

Previously you needed to use TypeScript 4.3 or newer when using the esbuild package from TypeScript code due to the use of a getter in an interface in node_modules/esbuild/lib/main.d.ts. This release removes this newer syntax to allow people with versions of TypeScript as far back as TypeScript 3.5 to use this latest version of the esbuild package. Here is change that was made to esbuild's type declarations:
```
 export interface OutputFile {
   /** "text" as bytes */
   contents: Uint8Array;
   /** "contents" as text (changes automatically with "contents") */
-  get text(): string;
+  readonly text: string;
 }
```

`v0.16.14`

Compare Source

Preserve some comments in expressions (#2721)

Various tools give semantic meaning to comments embedded inside of expressions. For example, Webpack and Vite have special "magic comments" that can be used to affect code splitting behavior:
```
import(/* webpackChunkName: "foo" */ '../foo');
import(/* @&#8203;vite-ignore */ dynamicVar);
new Worker(/* webpackChunkName: "bar" */ new URL("../bar.ts", import.meta.url));
new Worker(new URL('./path', import.meta.url), /* @&#8203;vite-ignore */ dynamicOptions);
```
Since esbuild can be used as a preprocessor for these tools (e.g. to strip TypeScript types), it can be problematic if esbuild doesn't do additional work to try to retain these comments. Previously esbuild special-cased Webpack comments in these specific locations in the AST. But Vite would now like to use similar comments, and likely other tools as well.

So with this release, esbuild now will attempt to preserve some comments inside of expressions in more situations than before. This behavior is mainly intended to preserve these special "magic comments" that are meant for other tools to consume, although esbuild will no longer only preserve Webpack-specific comments so it should now be tool-agnostic. There is no guarantee that all such comments will be preserved (especially when --minify-syntax is enabled). So this change does not mean that esbuild is now usable as a code formatter. In particular comment preservation is more likely to happen with leading comments than with trailing comments. You should put comments that you want to be preserved before the relevant expression instead of after it. Also note that this change does not retain any more statement-level comments than before (i.e. comments not embedded inside of expressions). Comment preservation is not enabled when --minify-whitespace is enabled (which is automatically enabled when you use --minify).

`v0.16.13`

Compare Source

Publish a new bundle visualization tool

While esbuild provides bundle metadata via the --metafile flag, previously esbuild left analysis of it completely up to third-party tools (well, outside of the rudimentary --analyze flag). However, the esbuild website now has a built-in bundle visualization tool:
- https://esbuild.github.io/analyze/
You can pass --metafile to esbuild to output bundle metadata, then upload that JSON file to this tool to visualize your bundle. This is helpful for answering questions such as:
- Which packages are included in my bundle?
- How did a specific file get included?
- How small did a specific file compress to?
- Was a specific file tree-shaken or not?
I'm publishing this tool because I think esbuild should provide some answer to "how do I visualize my bundle" without requiring people to reach for third-party tools. At the moment the tool offers two types of visualizations: a radial "sunburst chart" and a linear "flame chart". They serve slightly different but overlapping use cases (e.g. the sunburst chart is more keyboard-accessible while the flame chart is easier with the mouse). This tool may continue to evolve over time.
Fix --metafile and --mangle-cache with --watch (#1357)

The CLI calls the Go API and then also writes out the metafile and/or mangle cache JSON files if those features are enabled. This extra step is necessary because these files are returned by the Go API as in-memory strings. However, this extra step accidentally didn't happen for all builds after the initial build when watch mode was enabled. This behavior used to work but it was broken in version 0.14.18 by the introduction of the mangle cache feature. This release fixes the combination of these features, so the metafile and mangle cache features should now work with watch mode. This behavior was only broken for the CLI, not for the JS or Go APIs.
Add an original field to the metafile

The metadata file JSON now has an additional field: each import in an input file now contains the pre-resolved path in the original field in addition to the post-resolved path in the path field. This means it's now possible to run certain additional analysis over your bundle. For example, you should be able to use this to detect when the same package subpath is represented multiple times in the bundle, either because multiple versions of a package were bundled or because a package is experiencing the dual-package hazard.

`v0.16.12`

Compare Source

Loader defaults to js for extensionless files (#2776)

Certain packages contain files without an extension. For example, the yargs package contains the file yargs/yargs which has no extension. Node, Webpack, and Parcel can all understand code that imports yargs/yargs because they assume that the file is JavaScript. However, esbuild was previously unable to understand this code because it relies on the file extension to tell it how to interpret the file. With this release, esbuild will now assume files without an extension are JavaScript files. This can be customized by setting the loader for "" (the empty string, representing files without an extension) to another loader. For example, if you want files without an extension to be treated as CSS instead, you can do that like this:
- CLI:
```
esbuild --bundle --loader:=css
```
- JS:
```
esbuild.build({
  bundle: true,
  loader: { '': 'css' },
})
```
- Go:
```
api.Build(api.BuildOptions{
  Bundle: true,
  Loader: map[string]api.Loader{"": api.LoaderCSS},
})
```
In addition, the "type" field in package.json files now only applies to files with an explicit .js, .jsx, .ts, or .tsx extension. Previously it was incorrectly applied by esbuild to all files that had an extension other than .mjs, .mts, .cjs, or .cts including extensionless files. So for example an extensionless file in a "type": "module" package is now treated as CommonJS instead of ESM.

`v0.16.11`

Compare Source

Avoid a syntax error in the presence of direct eval (#2761)

The behavior of nested function declarations in JavaScript depends on whether the code is run in strict mode or not. It would be problematic if esbuild preserved nested function declarations in its output because then the behavior would depend on whether the output was run in strict mode or not instead of respecting the strict mode behavior of the original source code. To avoid this, esbuild transforms nested function declarations to preserve the intended behavior of the original source code regardless of whether the output is run in strict mode or not:
```
// Original code
if (true) {
  function foo() {}
  console.log(!!foo)
  foo = null
  console.log(!!foo)
}
console.log(!!foo)

// Transformed code
if (true) {
  let foo2 = function() {
  };
  var foo = foo2;
  console.log(!!foo2);
  foo2 = null;
  console.log(!!foo2);
}
console.log(!!foo);
```
In the above example, the original code should print true false true because it's not run in strict mode (it doesn't contain "use strict" and is not an ES module). The code that esbuild generates has been transformed such that it prints true false true regardless of whether it's run in strict mode or not.

However, this transformation is impossible if the code contains direct eval because direct eval "poisons" all containing scopes by preventing anything in those scopes from being renamed. That prevents esbuild from splitting up accesses to foo into two separate variables with different names. Previously esbuild still did this transformation but with two variables both named foo, which is a syntax error. With this release esbuild will now skip doing this transformation when direct eval is present to avoid generating code with a syntax error. This means that the generated code may no longer behave as intended since the behavior depends on the run-time strict mode setting instead of the strict mode setting present in the original source code. To fix this problem, you will need to remove the use of direct eval.
Fix a bundling scenario involving multiple symlinks (#2773, #2774)

This release contains a fix for a bundling scenario involving an import path where multiple path segments are symlinks. Previously esbuild was unable to resolve certain import paths in this scenario, but these import paths should now work starting with this release. This fix was contributed by @onebytegone.

`v0.16.10`

Compare Source

Change the default "legal comment" behavior again (#2745)

The legal comments feature automatically gathers comments containing @license or @preserve and puts the comments somewhere (either in the generated code or in a separate file). This behavior used to be on by default but was disabled by default in version 0.16.0 because automatically inserting comments is potentially confusing and misleading. These comments can appear to be assigning the copyright of your code to another entity. And this behavior can be especially problematic if it happens automatically by default since you may not even be aware of it happening. For example, if you bundle the TypeScript compiler the preserving legal comments means your source code would contain this comment, which appears to be assigning the copyright of all of your code to Microsoft:

/*! *****************************************************************************
Copyright (c) Microsoft Corporation. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use
this file except in compliance with the License. You may obtain a copy of the
License at http://www.apache.org/licenses/LICENSE-2.0

THIS CODE IS PROVIDED ON AN *AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED
WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A PARTICULAR PURPOSE,
MERCHANTABLITY OR NON-INFRINGEMENT.

See the Apache Version 2.0 License for specific language governing permissions
and limitations under the License.
***************************************************************************** */

However, people have asked for this feature to be re-enabled by default. To resolve the confusion about what these comments are applying to, esbuild's default behavior will now be to attempt to describe which package the comments are coming from. So while this feature has been re-enabled by default, the output will now look something like this instead:

/*! Bundled license information:

typescript/lib/typescript.js:
  (*! *****************************************************************************
  Copyright (c) Microsoft Corporation. All rights reserved.
  Licensed under the Apache License, Version 2.0 (the "License"); you may not use
  this file except in compliance with the License. You may obtain a copy of the
  License at http://www.apache.org/licenses/LICENSE-2.0

  THIS CODE IS PROVIDED ON AN *AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED
  WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A PARTICULAR PURPOSE,
  MERCHANTABLITY OR NON-INFRINGEMENT.

  See the Apache Version 2.0 License for specific language governing permissions
  and limitations under the License.
  ***************************************************************************** *)
*/

Note that you can still customize this behavior with the --legal-comments= flag. For example, you can use --legal-comments=none to turn this off, or you can use --legal-comments=linked to put these comments in a separate .LEGAL.txt file instead.

Enable external legal comments with the transform API (#2390)

Previously esbuild's transform API only supported none, inline, or eof legal comments. With this release, external legal comments are now also supported with the transform API. This only applies to the JS and Go APIs, not to the CLI, and looks like this:
- JS:
```
const { code, legalComments } = await esbuild.transform(input, {
  legalComments: 'external',
})
```
- Go:
```
result := api.Transform(input, api.TransformOptions{
  LegalComments: api.LegalCommentsEndOfFile,
})
code := result.Code
legalComments := result.LegalComments
```
Fix duplicate function declaration edge cases (#2757)

The change in the previous release to forbid duplicate function declarations in certain cases accidentally forbid some edge cases that should have been allowed. Specifically duplicate function declarations are forbidden in nested blocks in strict mode and at the top level of modules, but are allowed when they are declared at the top level of function bodies. This release fixes the regression by re-allowing the last case.
Allow package subpaths with alias (#2715)

Previously the names passed to the alias feature had to be the name of a package (with or without a package scope). With this release, you can now also use the alias feature with package subpaths. So for example you can now create an alias that substitutes @org/pkg/lib with something else.

`v0.16.9`

Compare Source

Update to Unicode 15.0.0

The character tables that determine which characters form valid JavaScript identifiers have been updated from Unicode version 14.0.0 to the newly-released Unicode version 15.0.0. I'm not putting an example in the release notes because all of the new characters will likely just show up as little squares since fonts haven't been updated yet. But you can read https://www.unicode.org/versions/Unicode15.0.0/#Summary for more information about the changes.
Disallow duplicate lexically-declared names in nested blocks and in strict mode

In strict mode or in a nested block, it's supposed to be a syntax error to declare two symbols with the same name unless all duplicate entries are either function declarations or all var declarations. However, esbuild was overly permissive and allowed this when duplicate entries were either function declarations or var declarations (even if they were mixed). This check has now been made more restrictive to match the JavaScript specification:
```
// JavaScript allows this
var a
function a() {}
{
  var b
  var b
  function c() {}
  function c() {}
}

// JavaScript doesn't allow this
{
  var d
  function d() {}
}
```
Add a type declaration for the new empty loader (#2755)

I forgot to add this in the previous release. It has now been added.

This fix was contributed by @fz6m.
Add support for the v flag in regular expression literals

People are currently working on adding a v flag to JavaScript regular expresions. You can read more about this flag here: https://v8.dev/features/regexp-v-flag. This release adds support for parsing this flag, so esbuild will now no longer consider regular expression literals with this flag to be a syntax error. If the target is set to something other than esnext, esbuild will transform regular expression literals containing this flag into a new RegExp() constructor call so the resulting code doesn't have a syntax error. This enables you to provide a polyfill for RegExp that implements the v flag to get your code to work at run-time. While esbuild doesn't typically adopt proposals until they're already shipping in a real JavaScript run-time, I'm adding it now because a) esbuild's implementation doesn't need to change as the proposal evolves, b) this isn't really new syntax since regular expression literals already have flags, and c) esbuild's implementation is a trivial pass-through anyway.
Avoid keeping the name of classes with static name properties

The --keep-names property attempts to preserve the original value of the name property for functions and classes even when identifiers are renamed by the minifier or to avoid a name collision. This is currently done by generating code to assign a string to the name property on the function or class object. However, this should not be done for classes with a static name property since in that case the explicitly-defined name property overwrites the automatically-generated class name. With this release, esbuild will now no longer attempt to preserve the name property for classes with a static name property.

`v0.16.8`

Compare Source

Allow plugins to resolve injected files (#2754)

Previously paths passed to the inject feature were always interpreted as file system paths. This meant that onResolve plugins would not be run for them and esbuild's default path resolver would always be used. This meant that the inject feature couldn't be used in the browser since the browser doesn't have access to a file system. This release runs paths passed to inject through esbuild's full path resolution pipeline so plugins now have a chance to handle them using onResolve callbacks. This makes it possible to write a plugin that makes esbuild's inject work in the browser.
Add the empty loader (#1541, #2753)

The new empty loader tells esbuild to pretend that a file is empty. So for example --loader:.css=empty effectively skips all imports of .css files in JavaScript so that they aren't included in the bundle, since import "./some-empty-file" in JavaScript doesn't bundle anything. You can also use the empty loader to remove asset references in CSS files. For example --loader:.png=empty causes esbuild to replace asset references such as url(image.png) with url() so that they are no longer included in the resulting style sheet.
Fix </script> and </style> escaping for non-default targets (#2748)

The change in version 0.16.0 to give control over </script> escaping via --supported:inline-script=false or --supported:inline-script=true accidentally broke automatic escaping of </script> when an explicit target setting is specified. This release restores the correct automatic escaping of </script> (which should not depend on what target is set to).
Enable the exports field with NODE_PATHS (#2752)

Node has a rarely-used feature where you can extend the set of directories that node searches for packages using the NODE_PATHS environment variable. While esbuild supports this too, previously it only supported the old main field path resolution but did not support the new exports field package resolution. This release makes the path resolution rules the same again for both node_modules directories and NODE_PATHS directories.

`v0.16.7`

Compare Source

Include file loader strings in metafile imports (#2731)

Bundling a file with the file loader copies that file to the output directory and imports a module with the path to the copied file in the default export. Previously when bundling with the file loader, there was no reference in the metafile from the JavaScript file containing the path string to the copied file. With this release, there will now be a reference in the metafile in the imports array with the kind file-loader:
```
 {
   ...
   "outputs": {
     "out/image-55CCFTCE.svg": {
       ...
     },
     "out/entry.js": {
       "imports": [
+        {
+          "path": "out/image-55CCFTCE.svg",
+          "kind": "file-loader"
+        }
       ],
       ...
     }
   }
 }
```
Fix byte counts in metafile regarding references to other output files (#2071)

Previously files that contained references to other output files had slightly incorrect metadata for the byte counts of input files which contributed to that output file. So for example if app.js imports image.png using the file loader and esbuild generates out.js and image-LSAMBFUD.png, the metadata for how many bytes of out.js are from app.js was slightly off (the metadata for the byte count of out.js was still correct). The reason is because esbuild substitutes the final paths for references between output files toward the end of the build to handle cyclic references, and the byte counts needed to be adjusted as well during the path substitution. This release fixes these byte counts (specifically the bytesInOutput values).
The alias feature now strips a trailing slash (#2730)

People sometimes add a trailing slash to the name of one of node's built-in modules to force node to import from the file system instead of importing the built-in module. For example, importing util imports node's built-in module called util but importing util/ tries to find a package called util on the file system. Previously attempting to use esbuild's package alias feature to replace imports to util with a specific file would fail because the file path would also gain a trailing slash (e.g. mapping util to ./file.js turned util/ into ./file.js/). With this release, esbuild will now omit the path suffix if it's a single trailing slash, which should now allow you to successfully apply aliases to these import paths.

`v0.16.6`

Compare Source

Do not mark subpath imports as external with --packages=external (#2741)

Node has a feature called subpath imports where special import paths that start with # are resolved using the imports field in the package.json file of the enclosing package. The intent of the newly-added --packages=external setting is to exclude a package's dependencies from the bundle. Since a package's subpath imports are only accessible within that package, it's wrong for them to be affected by --packages=external. This release changes esbuild so that --packages=external no longer affects subpath imports.
Forbid invalid numbers in JSON files

Previously esbuild parsed numbers in JSON files using the same syntax as JavaScript. But starting from this release, esbuild will now parse them with JSON syntax instead. This means the following numbers are no longer allowed by esbuild in JSON files:
- Legacy octal literals (non-zero integers starting with 0)
- The 0b, 0o, and 0x numeric prefixes
- Numbers containing _ such as 1_000
- Leading and trailing . such as 0. and .0
- Numbers with a space after the - such as - 1

Add external imports to metafile (#905, #1768, #1933, #1939)

External imports now appear in imports arrays in the metafile (which is present when bundling with metafile: true) next to normal imports, but additionally have external: true to set them apart. This applies both to files in the inputs section and the outputs section. Here's an example:

 {
   "inputs": {
     "style.css": {
       "bytes": 83,
       "imports": [
+        {
+          "path": "https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css",
+          "kind": "import-rule",
+          "external": true
+        }
       ]
     },
     "app.js": {
       "bytes": 100,
       "imports": [
+        {
+          "path": "https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/js/bootstrap.min.js",
+          "kind": "import-statement",
+          "external": true
+        },
         {
           "path": "style.css",
           "kind": "import-statement"
         }
       ]
     }
   },
   "outputs": {
     "out/app.js": {
       "imports": [
+        {
+          "path": "https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/js/bootstrap.min.js",
+          "kind": "require-call",
+          "external": true
+        }
       ],
       "exports": [],
       "entryPoint": "app.js",
       "cssBundle": "out/app.css",
       "inputs": {
         "app.js": {
           "bytesInOutput": 113
         },
         "style.css": {
           "bytesInOutput": 0
         }
       },
       "bytes": 528
     },
     "out/app.css": {
       "imports": [
+        {
+          "path": "https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css",
+          "kind": "import-rule",
+          "external": true
+        }
       ],
       "inputs": {
         "style.css": {
           "bytesInOutput": 0
         }
       },
       "bytes": 100
     }
   }
 }

One additional useful consequence of this is that the imports array is now populated when bundling is disabled. So you can now use esbuild with bundling disabled to inspect a file's imports.

`v0.16.5`

Compare Source

Make it easy to exclude all packages from a bundle (#1958, #1975, #2164, #2246, #2542)

When bundling for node, it's often necessary to exclude npm packages from the bundle since they weren't designed with esbuild bundling in mind and don't work correctly after being bundled. For example, they may use __dirname and run-time file system calls to load files, which doesn't work after bundling with esbuild. Or they may compile a native .node extension that has similar expectations about the layout of the file system that are no longer true after bundling (even if the .node extension is copied next to the bundle).

The way to get this to work with esbuild is to use the --external: flag. For example, the fsevents package contains a native .node extension and shouldn't be bundled. To bundle code that uses it, you can pass --external:fsevents to esbuild to exclude it from your bundle. You will then need to ensure that the fsevents package is still present when you run your bundle (e.g. by publishing your bundle to npm as a package with a dependency on fsevents).

It was possible to automatically do this for all of your dependencies, but it was inconvenient. You had to write some code that read your package.json file and passed the keys of the dependencies, devDependencies, peerDependencies, and/or optionalDependencies maps to esbuild as external packages (either that or write a plugin to mark all package paths as external). Previously esbuild's recommendation for making this easier was to do --external:./node_modules/* (added in version 0.14.13). However, this was a bad idea because it caused compatibility problems with many node packages as it caused esbuild to mark the post-resolve path as external instead of the pre-resolve path. Doing that could break packages that are published as both CommonJS and ESM if esbuild's bundler is also used to do a module format conversion.

With this release, you can now do the following to automatically exclude all packages from your bundle:
- CLI:
```
esbuild --bundle --packages=external
```
- JS:
```
esbuild.build({
  bundle: true,
  packages: 'external',
})
```
- Go:
```
api.Build(api.BuildOptions{
  Bundle:   true,
  Packages: api.PackagesExternal,
})
```
Doing --external:./node_modules/* is still possible and still has the same behavior, but is no longer recommended. I recommend that you use the new packages feature instead.

Fix some subtle bugs with tagged template literals

This release fixes a bug where minification could incorrectly change the value of this within tagged template literal function calls:

// Original code
function f(x) {
  let z = y.z
  return z``
}

// Old output (with --minify)
function f(n){return y.z``}

// New output (with --minify)
function f(n){return(0,y.z)``}

This release also fixes a bug where using optional chaining with --target=es2019 or earlier could incorrectly change the value of this within tagged template literal function calls:

// Original code
var obj = {
  foo: function() {
    console.log(this === obj);
  }
};
(obj?.foo)``;

// Old output (with --target=es6)
var obj = {
  foo: function() {
    console.log(this === obj);
  }
};
(obj == null ? void 0 : obj.foo)``;

// New output (with --target=es6)
var __freeze = Object.freeze;
var __defProp = Object.defineProperty;
var __template = (cooked, raw) => __freeze(__defProp(cooked, "raw", { value: __freeze(raw || cooked.slice()) }));
var _a;
var obj = {
  foo: function() {
    console.log(this === obj);
  }
};
(obj == null ? void 0 : obj.foo).call(obj, _a || (_a = __template([""])));

Some slight minification improvements

The following minification improvements were implemented:
- if (~a !== 0) throw x; => if (~a) throw x;
- if ((a | b) !== 0) throw x; => if (a | b) throw x;
- if ((a & b) !== 0) throw x; => if (a & b) throw x;
- if ((a ^ b) !== 0) throw x; => if (a ^ b) throw x;
- if ((a << b) !== 0) throw x; => if (a << b) throw x;
- if ((a >> b) !== 0) throw x; => if (a >> b) throw x;
- if ((a >>> b) !== 0) throw x; => if (a >>> b) throw x;
- if (!!a || !!b) throw x; => if (a || b) throw x;
- if (!!a && !!b) throw x; => if (a && b) throw x;
- if (a ? !!b : !!c) throw x; => if (a ? b : c) throw x;

`v0.16.4`

Compare Source

Fix binary downloads from the @esbuild/ scope for Deno (#2729)

Version 0.16.0 of esbuild moved esbuild's binary executables into npm packages under the @esbuild/ scope, which accidentally broke the binary downloader script for Deno. This release fixes this script so it should now be possible to use esbuild version 0.16.4+ with Deno.

`v0.16.3`

Compare Source

Fix a hang with the JS API in certain cases (#2727)

A change that was made in version 0.15.13 accidentally introduced a case when using esbuild's JS API could cause the node process to fail to exit. The change broke esbuild's watchdog timer, which detects if the parent process no longer exists and then automatically exits esbuild. This hang happened when you ran node as a child process with the stderr stream set to pipe instead of inherit, in the child process you call esbuild's JS API and pass incremental: true but do not call dispose() on the returned rebuild object, and then call process.exit(). In that case the parent node process was still waiting for the esbuild process that was created by the child node process to exit. The change made in version 0.15.13 was trying to avoid using Go's sync.WaitGroup API incorrectly because the API is not thread-safe. Instead of doing this, I have now reverted that change and implemented a thread-safe version of the sync.WaitGroup API for esbuild to use instead.

`v0.16.2`

Compare Source

Fix process.env.NODE_ENV substitution when transforming (#2718)

Version 0.16.0 introduced an unintentional regression that caused process.env.NODE_ENV to be automatically substituted with either "development" or "production" when using esbuild's transform API. This substitution is a necessary feature of esbuild's build API because the React framework crashes when you bundle it without doing this. But the transform API is typically used as part of a larger build pipeline so the benefit of esbuild doing this automatically is not as clear, and esbuild previously didn't do this.

However, version 0.16.0 switched the default value of the platform setting for the transform API from neutral to browser, both to align it with esbuild's documentation (which says browser is the default value) and because escaping the </script> character sequence is now tied to the browser platform (see the release notes for version 0.16.0 for details). That accidentally enabled automatic substitution of process.env.NODE_ENV because esbuild always did that for code meant for the browser. To fix this regression, esbuild will now only automatically substitute process.env.NODE_ENV when using the build API.
Prevent define from substituting constants into assignment position (#2719)

The define feature lets you replace certain expressions with constants. For example, you could use it to replace references to the global property reference window.DEBUG with false at compile time, which can then potentially help esbuild remove unused code from your bundle. It's similar to DefinePlugin in Webpack.

However, if you write code such as window.DEBUG = true and then defined window.DEBUG to false, esbuild previously generated the output false = true which is a syntax error in JavaScript. This behavior is not typically a problem because it doesn't make sense to substitute window.DEBUG with a constant if its value changes at run-time (Webpack's DefinePlugin also generates false = true in this case). But it can be alarming to have esbuild generate code with a syntax error.

So with this release, esbuild will no longer substitute define constants into assignment position to avoid generating code with a syntax error. Instead esbuild will generate a warning, which currently looks like this:
```
▲ [WARNING] Suspicious assignment to defined constant "window.DEBUG" [assign-to-define]

    example.js:1:0:
      1 │ window.DEBUG = true
        ╵ ~~~~~~~~~~~~

  The expression "window.DEBUG" has been configured to be replaced with a constant using the
  "define" feature. If this expression is supposed to be a compile-time constant, then it doesn't
  make sense to assign to it here. Or if this expression is supposed to change at run-time, this
  "define" substitution should be removed.
```
Fix a regression with npm install --no-optional (#2720)

Normally when you install esbuild with npm install, npm itself is the tool that downloads the correct binary executable for the current platform. This happens because of how esbuild's primary package uses npm's optionalDependencies feature. However, if you deliberately disable this with npm install --no-optional then esbuild's install script will attempt to repair the installation by manually downloading and extracting the binary executable from the package that was supposed to be installed.

The change in version 0.16.0 to move esbuild's nested packages into the @esbuild/ scope unintentionally broke this logic because of how npm's URL structure is different for scoped packages vs. normal packages. It was actually already broken for a few platforms earlier because esbuild already had packages for some platforms in the @esbuild/ scope, but I didn't discover this then because esbuild's integration tests aren't run on all platforms. Anyway, this release contains some changes to the install script that should hopefully get this scenario working again.

`v0.16.1`

Compare Source

Add format to input files in the JSON metafile data

When --metafile is enabled, input files may now have an additional format field that indicates the export format used by this file. When present, the value will either be cjs for CommonJS-style exports or esm for ESM-style exports. This can be useful in bundle analysis.

For example, esbuild's new Bundle Size Analyzer now uses this information to visualize whether ESM or CommonJS was used for each directory and file of source code (click on the CJS/ESM bar at the top).

This information is helpful when trying to reduce the size of your bundle. Using the ESM variant of a dependency instead of the CommonJS variant always results in a faster and smaller bundle because it omits CommonJS wrappers, and also may result in better tree-shaking as it allows esbuild to perform tree-shaking at the statement level instead of the module level.
Fix a bundling edge case with dynamic import (#2793)

This release fixes a bug where esbuild's bundler could produce incorrect output. The problematic edge case involves the entry point importing itself using a dynamic import() expression in an imported file, like this:
```
// src/a.js
export const A = 42;

// src/b.js
export const B = async () => (await import(".")).A

// src/index.js
export * from "./a"
export * from "./b"
```
Remove new type syntax from type declarations in the esbuild package (#2798)

Previously you needed to use TypeScript 4.3 or newer when using the esbuild package from TypeScript code due to the use of a getter in an interface in node_modules/esbuild/lib/main.d.ts. This release removes this newer syntax to allow people with versions of TypeScript as far back as TypeScript 3.5 to use this latest version of the esbuild package. Here is change that was made to esbuild's type declarations:
```
 export interface OutputFile {
   /** "text" as bytes */
   contents: Uint8Array;
   /** "contents" as text (changes automatically with "contents") */
-  get text(): string;
+  readonly text: string;
 }
```

`v0.16.0`

Compare Source

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.15.0 or ~0.15.0. See npm's documentation about semver for more information.

Move all binary executable packages to the @esbuild/ scope

Binary package executables for esbuild are published as individual packages separate from the main esbuild package so you only have to download the relevant one for the current platform when you install esbuild. This release moves all of these packages under the @esbuild/ scope to avoid collisions with 3rd-party packages. It also changes them to a consistent naming scheme that uses the os and cpu names from node.

The package name changes are as follows:
- @esbuild/linux-loong64 => @esbuild/linux-loong64 (no change)
- esbuild-android-64 => @esbuild/android-x64
- esbuild-android-arm64 => @esbuild/android-arm64
- esbuild-darwin-64 => @esbuild/darwin-x64
- esbuild-darwin-arm64 => @esbuild/darwin-arm64
- esbuild-freebsd-64 => @esbuild/freebsd-x64
- esbuild-freebsd-arm64 => @esbuild/freebsd-arm64
- esbuild-linux-32 => @esbuild/linux-ia32
- esbuild-linux-64 => @esbuild/linux-x64
- esbuild-linux-arm => @esbuild/linux-arm
- esbuild-linux-arm64 => @esbuild/linux-arm64
- esbuild-linux-mips64le => @esbuild/linux-mips64el
- esbuild-linux-ppc64le => @esbuild/linux-ppc64
- esbuild-linux-riscv64 => @esbuild/linux-riscv64
- esbuild-linux-s390x => @esbuild/linux-s390x
- esbuild-netbsd-64 => @esbuild/netbsd-x64
- esbuild-openbsd-64 => @esbuild/openbsd-x64
- esbuild-sunos-64 => @esbuild/sunos-x64
- esbuild-wasm => esbuild-wasm (no change)
- esbuild-windows-32 => @esbuild/win32-ia32
- esbuild-windows-64 => @esbuild/win32-x64
- esbuild-windows-arm64 => @esbuild/win32-arm64
- esbuild => esbuild (no change)
Normal usage of the esbuild and esbuild-wasm packages should not be affected. These name changes should only affect tools that hard-coded the individual binary executable package names into custom esbuild downloader scripts.

This change was not made with performance in mind. But as a bonus, installing esbuild with npm may potentially happen faster now. This is because npm's package installation protocol is inefficient: it always downloads metadata for all past versions of each package even when it only needs metadata about a single version. This makes npm package downloads O(n) in the number of published versions, which penalizes packages like esbuild that are updated regularly. Since most of esbuild's package names have now changed, npm will now need to download much less data when installing esbuild (8.72mb of package manifests before this change → 0.06mb of package manifests after this change). However, this is only a temporary improvement. Installing esbuild will gradually get slower again as further versions of esbuild are published.
Publish a shell script that downloads esbuild directly

In addition to all of the existing ways to install esbuild, you can now also download esbuild directly like this:
```
curl -fsSL https://esbuild.github.io/dl/latest | sh
```
This runs a small shell script that downloads the latest esbuild binary executable to the current directory. This can be convenient on systems that don't have npm installed or when you just want to get a copy of esbuild quickly without any extra steps. If you want a specific version of esbuild (starting with this version onward), you can provide that version in the URL instead of latest:
```
curl -fsSL https://esbuild.github.io/dl/v0.16.0 | sh
```
Note that the download script needs to be able to access registry.npmjs.org to be able to complete the download. This download script doesn't yet support all of the platforms that esbuild supports because I lack the necessary testing environments. If the download script doesn't work for you because you're on an unsupported platform, please file an issue on the esbuild repo so we can add support for it.
Fix some parameter names for the Go API

This release changes some parameter names for the Go API to be consistent with the JavaScript and CLI APIs:
- OutExtensions => OutExtension
- JSXMode => JSX
Add additional validation of API parameters

The JavaScript API now does some additional validation of API parameters to catch incorrect uses of esbuild's API. The biggest impact of this is likely that esbuild now strictly only accepts strings with the define parameter. This would already have been a type error with esbuild's TypeScript type definitions, but it was previously not enforced for people using esbuild's API JavaScript without TypeScript.

The define parameter appears at first glance to take a JSON object if you aren't paying close attention, but this actually isn't true. Values for define are instead strings of JavaScript code. This means you have to use define: { foo: '"bar"' } to replace foo with the string "bar". Using define: { foo: 'bar' } actually replaces foo with the identifier bar. Previously esbuild allowed you to pass define: { foo: false } and false was automatically converted into a string, which made it more confusing to understand what define actually represents. Starting with this release, passing non-string values such as with define: { foo: false } will no longer be allowed. You will now have to write define: { foo: 'false' } instead.
Generate shorter data URLs if possible (#1843)

Loading a file with esbuild's dataurl loader generates a JavaScript module with a data URL for that file in a string as a single default export. Previously the data URLs generated by esbuild all used base64 encoding. However, this is unnecessarily long for most textual data (e.g. SVG images). So with this release, esbuild's dataurl loader will now use percent encoding instead of base64 encoding if the result will be shorter. This can result in ~25% smaller data URLs for large SVGs. If you want the old behavior, you can use the base64 loader instead and then construct the data URL yourself.
Avoid marking entry points as external (#2382)

Previously you couldn't specify --external:* to mark all import paths as external because that also ended up making the entry point itself external, which caused the build to fail. With this release, esbuild's external API parameter no longer applies to entry points so using --external:* is now possible.

One additional consequence of this change is that the kind parameter is now required when calling the resolve() function in esbuild's plugin API. Previously the kind parameter defaulted to entry-point, but that no longer interacts with external so it didn't seem wise for this to continue to be the default. You now have to specify kind so that the path resolution mode is explicit.
Disallow non-default imports when assert { type: 'json' } is present

There is now standard behavior for importing a JSON file into an ES module using an import statement. However, it requires you to place the assert { type: 'json' } import assertion after the import path. This import assertion tells the JavaScript runtime to throw an error if the import does not end up resolving to a JSON file. On the web, the type of a file is determined by the Content-Type HTTP header instead of by the file extension. The import assertion prevents security problems on the web where a .json file may actually resolve to a JavaScript file containing malicious code, which is likely not expected for an import that is supposed to only contain pure side-effect free data.

By default, esbuild uses the file extension to determine the type of a file, so this import assertion is unnecessary with esbuild. However, esbuild's JSON import feature has a non-standard extension that allows you to import top-level properties of the JSON object as named imports. For example, esbuild lets you do this:
```
import { version } from './package.json'
```
This is useful for tree-shaking when bundling because it means esbuild will only include the the version field of package.json in your bundle. This is non-standard behavior though and doesn't match the behavior of what happens when you import JSON in a real JavaScript runtime (after adding assert { type: 'json' }). In a real JavaScript runtime the only thing you can import is the default import. So with this release, esbuild will now prevent you from importing non-default import names if assert { type: 'json' } is present. This ensures that code containing assert { type: 'json' } isn't relying on non-standard behavior that won't work everywhere. So the following code is now an error with esbuild when bundling:
```
import { version } from './package.json' assert { type: 'json' }
```
In addition, adding assert { type: 'json' } to an import statement now means esbuild will generate an error if the loader for the file is anything other than json, which is required by the import assertion specification.
Provide a way to disable automatic escaping of </script> (#2649)

If you inject esbuild's output into a script tag in an HTML file, code containing the literal characters </script> will cause the tag to be ended early which will break the code:
```
<script>
  console.log("</script>");
</script>
```
To avoid this, esbuild automatically escapes these strings in generated JavaScript files (e.g. "</script>" becomes "<\/script>" instead). This also applies to </style> in generated CSS files. Previously this always happened and there wasn't a way to turn this off.

With this release, esbuild will now only do this if the platform setting is set to browser (the default value). Setting platform to node or neutral will disable this behavior. This behavior can also now be disabled with --supported:inline-script=false (for JS) and --supported:inline-style=false (for CSS).
Throw an early error if decoded UTF-8 text isn't a Uint8Array (#2532)

If you run esbuild's JavaScript API in a broken JavaScript environment where new TextEncoder().encode("") instanceof Uint8Array is false, then esbuild's API will fail with a confusing serialization error message that makes it seem like esbuild has a bug even though the real problem is that the JavaScript environment itself is broken. This can happen when using the test framework called Jest. With this release, esbuild's API will now throw earlier when it detects that the environment is unable to encode UTF-8 text correctly with an error message that makes it more clear that this is not a problem with esbuild.
Change the default "legal comment" behavior

The legal comments feature automatically gathers comments containing @license or @preserve and puts the comments somewhere (either in the generated code or in a separate file). People sometimes want this to happen so that the their dependencies' software licenses are retained in the generated output code. By default esbuild puts these comments at the end of the file when bundling. However, people sometimes find this confusing because these comments can be very generic and may not mention which library they come from. So with this release, esbuild will now discard legal comments by default. You now have to opt-in to preserving them if you want this behavior.
Enable the module condition by default (#2417)

Package authors want to be able to use the new exports field in package.json to provide tree-shakable ESM code for ESM-aware bundlers while simultaneously providing fallback CommonJS code for other cases.

Node's proposed way to do this involves using the import and require export conditions so that you get the ESM code if you use an import statement and the CommonJS code if you use a require call. However, this has a major drawback: if some code in the bundle uses an import statement and other code in the bundle uses a require call, then you'll get two copies of the same package in the bundle. This is known as the dual package hazard and can lead to bloated bundles or even worse to subtle logic bugs.

Webpack supports an alternate solution: an export condition called module that takes effect regardless of whether the package was imported using an import statement or a require cal

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

coveralls · 2023-01-08T15:42:29Z

Pull Request Test Coverage Report for Build 3868654214

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage increased (+0.1%) to 95.987%

Totals
Change from base Build 3868644370:	0.1%
Covered Lines:	4055
Relevant Lines:	4154

💛 - Coveralls

renovate bot requested a review from kulshekhar as a code owner January 8, 2023 15:26

renovate bot force-pushed the renovate/esbuild-packages branch from c9ce5e3 to 3f14cc3 Compare January 8, 2023 15:43

ahnpnl previously approved these changes Jan 8, 2023

View reviewed changes

build(deps): Update dependency esbuild to ~0.16.15

fcf1dbc

renovate bot dismissed ahnpnl’s stale review via fcf1dbc January 8, 2023 19:39

renovate bot force-pushed the renovate/esbuild-packages branch from 3f14cc3 to fcf1dbc Compare January 8, 2023 19:39

ahnpnl approved these changes Jan 8, 2023

View reviewed changes

ahnpnl merged commit 7a45073 into main Jan 8, 2023

renovate bot deleted the renovate/esbuild-packages branch January 8, 2023 20:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): Update dependency esbuild to ~0.16.15 #3968

build(deps): Update dependency esbuild to ~0.16.15 #3968

renovate bot commented Jan 8, 2023

coveralls commented Jan 8, 2023 •

edited

Loading

build(deps): Update dependency esbuild to ~0.16.15 #3968

build(deps): Update dependency esbuild to ~0.16.15 #3968

Conversation

renovate bot commented Jan 8, 2023

Release Notes

Configuration

coveralls commented Jan 8, 2023 • edited Loading

Pull Request Test Coverage Report for Build 3868654214

💛 - Coveralls

coveralls commented Jan 8, 2023 •

edited

Loading