Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
esbuild-wasm
Advanced tools
The esbuild-wasm package is a WebAssembly-based version of the esbuild bundler and minifier. It provides extremely fast build times and is designed to be used in environments where native binaries cannot be executed, such as in browsers or some serverless platforms. It supports transforming, bundling, and minifying JavaScript and TypeScript files.
Bundling JavaScript
This code initializes esbuild-wasm and bundles a JavaScript file, outputting a single bundled file. It demonstrates how to set up and execute a basic bundling process.
const esbuild = require('esbuild-wasm');
esbuild.initialize({ worker: true, wasmURL: '/path/to/esbuild.wasm' }).then(() => {
esbuild.build({
entryPoints: ['input.js'],
bundle: true,
outfile: 'output.js'
}).catch(() => process.exit(1));
});
Minifying CSS
This example shows how to use esbuild-wasm to minify a CSS file. It sets up the esbuild environment and performs minification, outputting the minified CSS.
const esbuild = require('esbuild-wasm');
esbuild.initialize({ worker: true, wasmURL: '/path/to/esbuild.wasm' }).then(() => {
esbuild.build({
entryPoints: ['input.css'],
minify: true,
outfile: 'output.css'
}).catch(() => process.exit(1));
});
Transpiling TypeScript
This code snippet demonstrates how to transpile TypeScript into JavaScript using esbuild-wasm. It includes setting up the environment, specifying the loader for TypeScript files, and bundling the output.
const esbuild = require('esbuild-wasm');
esbuild.initialize({ worker: true, wasmURL: '/path/to/esbuild.wasm' }).then(() => {
esbuild.build({
entryPoints: ['input.ts'],
loader: { '.ts': 'ts' },
outfile: 'output.js',
bundle: true
}).catch(() => process.exit(1));
});
Webpack is a popular JavaScript module bundler with a vast ecosystem of plugins. It offers more configuration options and plugins compared to esbuild-wasm but is generally slower in terms of build speed.
Rollup is another module bundler that focuses on producing efficient bundles. It is known for its tree-shaking capabilities, which are similar to esbuild-wasm, but Rollup typically has slower build times and less efficient minification.
Parcel is a web application bundler that requires zero configuration for quick setup. It provides fast build times similar to esbuild-wasm and supports various file types natively, but it might not reach the same speed for larger projects.
This is the cross-platform WebAssembly binary for esbuild, a JavaScript bundler and minifier. See https://github.com/evanw/esbuild and the JavaScript API documentation for details.
0.20.2
Support TypeScript experimental decorators on abstract
class fields (#3684)
With this release, you can now use TypeScript experimental decorators on abstract
class fields. This was silently compiled incorrectly in esbuild 0.19.7 and below, and was an error from esbuild 0.19.8 to esbuild 0.20.1. Code such as the following should now work correctly:
// Original code
const log = (x: any, y: string) => console.log(y)
abstract class Foo { @log abstract foo: string }
new class extends Foo { foo = '' }
// Old output (with --loader=ts --tsconfig-raw={\"compilerOptions\":{\"experimentalDecorators\":true}})
const log = (x, y) => console.log(y);
class Foo {
}
new class extends Foo {
foo = "";
}();
// New output (with --loader=ts --tsconfig-raw={\"compilerOptions\":{\"experimentalDecorators\":true}})
const log = (x, y) => console.log(y);
class Foo {
}
__decorateClass([
log
], Foo.prototype, "foo", 2);
new class extends Foo {
foo = "";
}();
JSON loader now preserves __proto__
properties (#3700)
Copying JSON source code into a JavaScript file will change its meaning if a JSON object contains the __proto__
key. A literal __proto__
property in a JavaScript object literal sets the prototype of the object instead of adding a property named __proto__
, while a literal __proto__
property in a JSON object literal just adds a property named __proto__
. With this release, esbuild will now work around this problem by converting JSON to JavaScript with a computed property key in this case:
// Original code
import data from 'data:application/json,{"__proto__":{"fail":true}}'
if (Object.getPrototypeOf(data)?.fail) throw 'fail'
// Old output (with --bundle)
(() => {
// <data:application/json,{"__proto__":{"fail":true}}>
var json_proto_fail_true_default = { __proto__: { fail: true } };
// entry.js
if (Object.getPrototypeOf(json_proto_fail_true_default)?.fail)
throw "fail";
})();
// New output (with --bundle)
(() => {
// <data:application/json,{"__proto__":{"fail":true}}>
var json_proto_fail_true_default = { ["__proto__"]: { fail: true } };
// example.mjs
if (Object.getPrototypeOf(json_proto_fail_true_default)?.fail)
throw "fail";
})();
Improve dead code removal of switch
statements (#3659)
With this release, esbuild will now remove switch
statements in branches when minifying if they are known to never be evaluated:
// Original code
if (true) foo(); else switch (bar) { case 1: baz(); break }
// Old output (with --minify)
if(1)foo();else switch(bar){case 1:}
// New output (with --minify)
foo();
Empty enums should behave like an object literal (#3657)
TypeScript allows you to create an empty enum and add properties to it at run time. While people usually use an empty object literal for this instead of a TypeScript enum, esbuild's enum transform didn't anticipate this use case and generated undefined
instead of {}
for an empty enum. With this release, you can now use an empty enum to generate an empty object literal.
// Original code
enum Foo {}
// Old output (with --loader=ts)
var Foo = /* @__PURE__ */ ((Foo2) => {
})(Foo || {});
// New output (with --loader=ts)
var Foo = /* @__PURE__ */ ((Foo2) => {
return Foo2;
})(Foo || {});
Handle Yarn Plug'n'Play edge case with tsconfig.json
(#3698)
Previously a tsconfig.json
file that extends
another file in a package with an exports
map failed to work when Yarn's Plug'n'Play resolution was active. This edge case should work now starting with this release.
Work around issues with Deno 1.31+ (#3682)
Version 0.20.0 of esbuild changed how the esbuild child process is run in esbuild's API for Deno. Previously it used Deno.run
but that API is being removed in favor of Deno.Command
. As part of this change, esbuild is now calling the new unref
function on esbuild's long-lived child process, which is supposed to allow Deno to exit when your code has finished running even though the child process is still around (previously you had to explicitly call esbuild's stop()
function to terminate the child process for Deno to be able to exit).
However, this introduced a problem for Deno's testing API which now fails some tests that use esbuild with error: Promise resolution is still pending but the event loop has already resolved
. It's unclear to me why this is happening. The call to unref
was recommended by someone on the Deno core team, and calling Node's equivalent unref
API has been working fine for esbuild in Node for a long time. It could be that I'm using it incorrectly, or that there's some reference counting and/or garbage collection bug in Deno's internals, or that Deno's unref
just works differently than Node's unref
. In any case, it's not good for Deno tests that use esbuild to be failing.
In this release, I am removing the call to unref
to fix this issue. This means that you will now have to call esbuild's stop()
function to allow Deno to exit, just like you did before esbuild version 0.20.0 when this regression was introduced.
Note: This regression wasn't caught earlier because Deno doesn't seem to fail tests that have outstanding setTimeout
calls, which esbuild's test harness was using to enforce a maximum test runtime. Adding a setTimeout
was allowing esbuild's Deno tests to succeed. So this regression doesn't necessarily apply to all people using tests in Deno.
FAQs
The cross-platform WebAssembly binary for esbuild, a JavaScript bundler.
The npm package esbuild-wasm receives a total of 1,350,205 weekly downloads. As such, esbuild-wasm popularity was classified as popular.
We found that esbuild-wasm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.