Security News
Opengrep Emerges as Open Source Alternative Amid Semgrep Licensing Controversy
Opengrep forks Semgrep to preserve open source SAST in response to controversial licensing changes.
esbuild is a fast JavaScript bundler and minifier. It compiles TypeScript and JavaScript into a single file, minifies it, and can also handle CSS and image assets. It's designed for speed and efficiency, utilizing parallelism and native Go code to achieve its performance.
Bundling JavaScript
This code bundles 'app.js' and its dependencies into a single file 'out.js'.
require('esbuild').build({
entryPoints: ['app.js'],
bundle: true,
outfile: 'out.js'
}).catch(() => process.exit(1))
Minifying JavaScript
This code minifies 'app.js' to reduce file size and improve load times.
require('esbuild').build({
entryPoints: ['app.js'],
minify: true,
outfile: 'out.js'
}).catch(() => process.exit(1))
Transpiling TypeScript
This code compiles a TypeScript file 'app.ts' into JavaScript and bundles it into 'out.js'.
require('esbuild').build({
entryPoints: ['app.ts'],
bundle: true,
outfile: 'out.js'
}).catch(() => process.exit(1))
Serving files for development
This code starts a local server to serve files from the 'public' directory and bundles 'app.js' into 'public/out.js'.
require('esbuild').serve({
servedir: 'public',
port: 8000
}, {
entryPoints: ['app.js'],
bundle: true,
outfile: 'public/out.js'
}).then(server => {
// Server started
})
Webpack is a powerful and widely-used module bundler. It offers a rich plugin ecosystem and a highly configurable build process. Compared to esbuild, webpack is more mature with more features but is generally slower due to its JavaScript-based architecture.
Rollup is another JavaScript module bundler that focuses on producing efficient bundles for modern module formats like ES modules. It's known for its tree-shaking capabilities. Rollup is typically faster than webpack but slower than esbuild.
Parcel is a web application bundler that offers zero configuration out-of-the-box. It's faster than webpack and rollup but generally not as fast as esbuild. Parcel has a simpler user experience but may not be as flexible for complex configurations.
Terser is a JavaScript parser, mangler, and compressor toolkit for ES6+. It's often used for minifying JavaScript code. While esbuild also minifies code, terser is a dedicated tool for this purpose and can be used alongside other bundlers.
This is a JavaScript bundler and minifier. See https://github.com/evanw/esbuild and the JavaScript API documentation for details.
0.20.2
Support TypeScript experimental decorators on abstract
class fields (#3684)
With this release, you can now use TypeScript experimental decorators on abstract
class fields. This was silently compiled incorrectly in esbuild 0.19.7 and below, and was an error from esbuild 0.19.8 to esbuild 0.20.1. Code such as the following should now work correctly:
// Original code
const log = (x: any, y: string) => console.log(y)
abstract class Foo { @log abstract foo: string }
new class extends Foo { foo = '' }
// Old output (with --loader=ts --tsconfig-raw={\"compilerOptions\":{\"experimentalDecorators\":true}})
const log = (x, y) => console.log(y);
class Foo {
}
new class extends Foo {
foo = "";
}();
// New output (with --loader=ts --tsconfig-raw={\"compilerOptions\":{\"experimentalDecorators\":true}})
const log = (x, y) => console.log(y);
class Foo {
}
__decorateClass([
log
], Foo.prototype, "foo", 2);
new class extends Foo {
foo = "";
}();
JSON loader now preserves __proto__
properties (#3700)
Copying JSON source code into a JavaScript file will change its meaning if a JSON object contains the __proto__
key. A literal __proto__
property in a JavaScript object literal sets the prototype of the object instead of adding a property named __proto__
, while a literal __proto__
property in a JSON object literal just adds a property named __proto__
. With this release, esbuild will now work around this problem by converting JSON to JavaScript with a computed property key in this case:
// Original code
import data from 'data:application/json,{"__proto__":{"fail":true}}'
if (Object.getPrototypeOf(data)?.fail) throw 'fail'
// Old output (with --bundle)
(() => {
// <data:application/json,{"__proto__":{"fail":true}}>
var json_proto_fail_true_default = { __proto__: { fail: true } };
// entry.js
if (Object.getPrototypeOf(json_proto_fail_true_default)?.fail)
throw "fail";
})();
// New output (with --bundle)
(() => {
// <data:application/json,{"__proto__":{"fail":true}}>
var json_proto_fail_true_default = { ["__proto__"]: { fail: true } };
// example.mjs
if (Object.getPrototypeOf(json_proto_fail_true_default)?.fail)
throw "fail";
})();
Improve dead code removal of switch
statements (#3659)
With this release, esbuild will now remove switch
statements in branches when minifying if they are known to never be evaluated:
// Original code
if (true) foo(); else switch (bar) { case 1: baz(); break }
// Old output (with --minify)
if(1)foo();else switch(bar){case 1:}
// New output (with --minify)
foo();
Empty enums should behave like an object literal (#3657)
TypeScript allows you to create an empty enum and add properties to it at run time. While people usually use an empty object literal for this instead of a TypeScript enum, esbuild's enum transform didn't anticipate this use case and generated undefined
instead of {}
for an empty enum. With this release, you can now use an empty enum to generate an empty object literal.
// Original code
enum Foo {}
// Old output (with --loader=ts)
var Foo = /* @__PURE__ */ ((Foo2) => {
})(Foo || {});
// New output (with --loader=ts)
var Foo = /* @__PURE__ */ ((Foo2) => {
return Foo2;
})(Foo || {});
Handle Yarn Plug'n'Play edge case with tsconfig.json
(#3698)
Previously a tsconfig.json
file that extends
another file in a package with an exports
map failed to work when Yarn's Plug'n'Play resolution was active. This edge case should work now starting with this release.
Work around issues with Deno 1.31+ (#3682)
Version 0.20.0 of esbuild changed how the esbuild child process is run in esbuild's API for Deno. Previously it used Deno.run
but that API is being removed in favor of Deno.Command
. As part of this change, esbuild is now calling the new unref
function on esbuild's long-lived child process, which is supposed to allow Deno to exit when your code has finished running even though the child process is still around (previously you had to explicitly call esbuild's stop()
function to terminate the child process for Deno to be able to exit).
However, this introduced a problem for Deno's testing API which now fails some tests that use esbuild with error: Promise resolution is still pending but the event loop has already resolved
. It's unclear to me why this is happening. The call to unref
was recommended by someone on the Deno core team, and calling Node's equivalent unref
API has been working fine for esbuild in Node for a long time. It could be that I'm using it incorrectly, or that there's some reference counting and/or garbage collection bug in Deno's internals, or that Deno's unref
just works differently than Node's unref
. In any case, it's not good for Deno tests that use esbuild to be failing.
In this release, I am removing the call to unref
to fix this issue. This means that you will now have to call esbuild's stop()
function to allow Deno to exit, just like you did before esbuild version 0.20.0 when this regression was introduced.
Note: This regression wasn't caught earlier because Deno doesn't seem to fail tests that have outstanding setTimeout
calls, which esbuild's test harness was using to enforce a maximum test runtime. Adding a setTimeout
was allowing esbuild's Deno tests to succeed. So this regression doesn't necessarily apply to all people using tests in Deno.
FAQs
An extremely fast JavaScript and CSS bundler and minifier.
The npm package esbuild receives a total of 35,817,648 weekly downloads. As such, esbuild popularity was classified as popular.
We found that esbuild demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Opengrep forks Semgrep to preserve open source SAST in response to controversial licensing changes.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.