
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
💛 You can help the author become a full-time open-source maintainer by sponsoring him on GitHub.
This is a dev server and a bundler based on esbuild. Very early stage, don't use it for serious projects.
This guide is heavily copied from Vite, since their usages are very similar.
Vite shines at local development, it features a no-bundle dev server which is very fast and has a very good support for HMR. Thanks to dependency prebundling with esbuild, Vite can also create a production build fast using Rollup.
The idea of Haya is not to replace Vite at development, Haya's dev server works, as long as full page reloading works for your app, but the main goal is to make the production build even faster by fully leveraging esbuild. Currently Haya can already build Vite's default starter projects, and it's trying to keep improving on that.
I plan to at least add HMR for CSS files, but HMR for JS files needs better support from esbuild itself, and it won't be there anytime soon.
npm i haya -D
Use aho to download the starter project:
npx aho@latest egoist/haya/template my-app
cd my-app
npm i
# start dev server
npm run dev
# build for production
npm run build
# preview production build
npm run preview
haya [dir]: Start dev server, treat dir as root directory, defaults to .haya build [dir]: Build for production, output files go to [dir]/disthaya preview [dir]: Preview the production build in [dir]/dist.haya expects a index.html file in the root directory. You can use <link> and <script> tags to reference and bundle external CSS and JavaScript/TypeScript.
<link> should have property rel="stylesheet" and href="/some/style.css"<script> should have property type="module" and src="/some/script.ts"haya uses esbuild to bundle your TypeScript and JavaScript files in ES Module format, with code splitting enabled (via dynamic import).
JSX/TSX works out of the box.
The recommended way to use CSS is to use <link> in index.html:
<link rel="stylesheet" href="/src/style.css" />
The generated index.html will look like:
<link rel="stylesheet" href="/0-style-[hash].css" />
However you can also directly import CSS files in TypeScript/JavaScript files:
import "./style.css"
It will also be included in generated index.html.
Note that the exported value of CSS files will be the its URL:
import style from "./style.css"
console.log(style)
//=> /style-[hash].css
If you want to get the URL without adding the CSS file to generated index.html, append ?import-only query to the module name:
import style from "./style.css?import-only"
Adding a postcss.config.js or postcss.config.cjs in your root directory to enable postcss.
LESS SOON.
There is NO hot module replacement, instead it does a full reloading of the page when a rebuild occurs.
You can directly configure aliases via tsconfig.json like this:
{
"compilerOptions": {
"baseUrl": ".",
"paths": {
"~/*": ["./src/*"]
}
}
}
Now ~/main will be resolved to ./src/main.
haya exposes env variables on the process.env object. Some built-in variables are available in all cases:
process.env.NODE_ENV: development in dev or production in production. We also have a special global variable __DEV__ which evaluates to true in dev and false in production..env Fileshaya uses dotenv to load additional environment variables from the following files in root directory:
.env # loaded in all cases
.env.local # loaded in all cases, ignored by git
.env.[mode] # only loaded in specified mode
.env.[mode].local # only loaded in specified mode, ignored by git
Loaded env variables are also exposed to your client source code via process.env.
To prevent accidentally leaking env variables to the client, only variables prefixed with HAYA_ are exposed to your haya-processed code. e.g. the following file:
DB_PASSWORD=foobar
HAYA_SOME_KEY=123
Only HAYA_SOME_KEY will be exposed as process.env.HAYA_SOME_KEY to your client source code, but DB_PASSWORD will not.
public directoryIf you have assets that are:
robots.txt)/ during dev, and copied to the root of the dist directory as-is.The directory defaults to <root>/public, but can be configured via the .publicDir option (not yet)
Note that:
public/icon.png should be referenced in source code as /icon.png.public cannot be imported from JavaScript.The output directory dist can be served as a static website, you can preview it locally using the haya preview command.
ssrLoadModule API from Vite.MIT © EGOIST
FAQs
esbuild based dev server and production bundler
We found that haya demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.