chore(deps): update dependency esbuild to v0.13.7 #841

renovate · 2021-10-15T23:02:28Z

renovate commented

2021-10-15 23:02:28 +00:00

This PR contains the following updates:

Package	Type	Update	Change
esbuild	devDependencies	patch	`0.13.4` -> `0.13.7`

Release Notes

evanw/esbuild

`v0.13.7`

Compare Source

Minify CSS alpha values correctly (#1682)

When esbuild uses the rgba() syntax for a color instead of the 8-character hex code (e.g. when target is set to Chrome 61 or earlier), the 0-to-255 integer alpha value must be printed as a floating-point fraction between 0 and 1. The fraction was only printed to three decimal places since that is the minimal number of decimal places required for all 256 different alpha values to be uniquely determined. However, using three decimal places does not necessarily result in the shortest result. For example, 128 / 255 is 0.5019607843137255 which is printed as ".502" using three decimal places, but ".5" is equivalent because round(0.5 * 255) == 128, so printing ".5" would be better. With this release, esbuild will always use the minimal numeric representation for the alpha value:
```
/* Original code */
a { color: #FF800080 }

/* Old output (with --minify --target=chrome61) */
a{color:rgba(255,128,0,.502)}

/* New output (with --minify --target=chrome61) */
a{color:rgba(255,128,0,.5)}
```
Match node's behavior for core module detection (#1680)

Node has a hard-coded list of core modules (e.g. fs) that, when required, short-circuit the module resolution algorithm and instead return the corresponding internal core module object. When you pass --platform=node to esbuild, esbuild also implements this short-circuiting behavior and doesn't try to bundle these import paths. This was implemented in esbuild using the existing external feature (e.g. essentially --external:fs). However, there is an edge case where esbuild's external feature behaved differently than node.

Modules specified via esbuild's external feature also cause all sub-paths to be excluded as well, so for example --external:foo excludes both foo and foo/bar from the bundle. However, node's core module check is only an exact equality check, so for example fs is a core module and bypasses the module resolution algorithm but fs/foo is not a core module and causes the module resolution algorithm to search the file system.

This behavior can be used to load a module on the file system with the same name as one of node's core modules. For example, require('fs/') will load the module fs from the file system instead of loading node's core fs module. With this release, esbuild will now match node's behavior in this edge case. This means the external modules that are automatically added by --platform=node now behave subtly differently than --external:, which allows code that relies on this behavior to be bundled correctly.
Fix WebAssembly builds on Go 1.17.2+ (#1684)

Go 1.17.2 introduces a change (specifically a fix for CVE-2021-38297) that causes Go's WebAssembly bootstrap script to throw an error when it's run in situations with many environment variables. One such situation is when the bootstrap script is run inside GitHub Actions. This change was introduced because the bootstrap script writes a copy of the environment variables into WebAssembly memory without any bounds checking, and writing more than 4096 bytes of data ends up writing past the end of the buffer and overwriting who-knows-what. So throwing an error in this situation is an improvement. However, this breaks esbuild which previously (at least seemingly) worked fine.

With this release, esbuild's WebAssembly bootstrap script that calls out to Go's WebAssembly bootstrap script will now delete all environment variables except for the ones that esbuild checks for, of which there are currently only four: NO_COLOR, NODE_PATH, npm_config_user_agent, and WT_SESSION. This should avoid a crash when esbuild is built using Go 1.17.2+ and should reduce the likelihood of memory corruption when esbuild is built using Go 1.17.1 or earlier. This release also updates the Go version that esbuild ships with to version 1.17.2. Note that this problem only affects the esbuild-wasm package. The esbuild package is not affected.

See also:
- https://github.com/golang/go/issues/48797
- https://github.com/golang/go/issues/49011

`v0.13.6`

Compare Source

Emit decorators for declare class fields (#1675)

In version 3.7, TypeScript introduced the declare keyword for class fields that avoids generating any code for that field:

// TypeScript input
class Foo {
  a: number
  declare b: number
}

// JavaScript output
class Foo {
  a;
}

However, it turns out that TypeScript still emits decorators for these omitted fields. With this release, esbuild will now do this too:

// TypeScript input
class Foo {
  @&#8203;decorator a: number;
  @&#8203;decorator declare b: number;
}

// Old JavaScript output
class Foo {
  a;
}
__decorateClass([
  decorator
], Foo.prototype, "a", 2);

// New JavaScript output
class Foo {
  a;
}
__decorateClass([
  decorator
], Foo.prototype, "a", 2);
__decorateClass([
  decorator
], Foo.prototype, "b", 2);

Experimental support for esbuild on NetBSD (#1624)

With this release, esbuild now has a published binary executable for NetBSD in the esbuild-netbsd-64 npm package, and esbuild's installer has been modified to attempt to use it when on NetBSD. Hopefully this makes installing esbuild via npm work on NetBSD. This change was contributed by @gdt.

⚠️ Note: NetBSD is not one of Node's supported platforms, so installing esbuild may or may not work on NetBSD depending on how Node has been patched. This is not a problem with esbuild. ⚠️
Disable the "esbuild was bundled" warning if ESBUILD_BINARY_PATH is provided (#1678)

The ESBUILD_BINARY_PATH environment variable allows you to substitute an alternate binary executable for esbuild's JavaScript API. This is useful in certain cases such as when debugging esbuild. The JavaScript API has some code that throws an error if it detects that it was bundled before being run, since bundling prevents esbuild from being able to find the path to its binary executable. However, that error is unnecessary if ESBUILD_BINARY_PATH is present because an alternate path has been provided. This release disables the warning when ESBUILD_BINARY_PATH is present so that esbuild can be used when bundled as long as you also manually specify ESBUILD_BINARY_PATH.

This change was contributed by @heypiotr.
Remove unused catch bindings when minifying (#1660)

With this release, esbuild will now remove unused catch bindings when minifying:
```
// Original code
try {
  throw 0;
} catch (e) {
}

// Old output (with --minify)
try{throw 0}catch(t){}

// New output (with --minify)
try{throw 0}catch{}
```
This takes advantage of the new optional catch binding syntax feature that was introduced in ES2019. This minification rule is only enabled when optional catch bindings are supported by the target environment. Specifically, it's not enabled when using --target=es2018 or older. Make sure to set esbuild's target setting correctly when minifying if the code will be running in an older JavaScript environment.

This change was contributed by @sapphi-red.

`v0.13.5`

Compare Source

Improve watch mode accuracy (#1113)

Watch mode is enabled by --watch and causes esbuild to become a long-running process that automatically rebuilds output files when input files are changed. It's implemented by recording all calls to esbuild's internal file system interface and then invalidating the build whenever these calls would return different values. For example, a call to esbuild's internal ReadFile() function is considered to be different if either the presence of the file has changed (e.g. the file didn't exist before but now exists) or the presence of the file stayed the same but the content of the file has changed.

Previously esbuild's watch mode operated at the ReadFile() and ReadDirectory() level. When esbuild checked whether a directory entry existed or not (e.g. whether a directory contains a node_modules subdirectory or a package.json file), it called ReadDirectory() which then caused the build to depend on that directory's set of entries. This meant the build would be invalidated even if a new unrelated entry was added or removed, since that still changes the set of entries. This is problematic when using esbuild in environments that constantly create and destroy temporary directory entries in your project directory. In that case, esbuild's watch mode would constantly rebuild as the directory was constantly considered to be dirty.

With this release, watch mode now operates at the ReadFile() and ReadDirectory().Get() level. So when esbuild checks whether a directory entry exists or not, the build should now only depend on the presence status for that one directory entry. This should avoid unnecessary rebuilds due to unrelated directory entries being added or removed. The log messages generated using --watch will now also mention the specific directory entry whose presence status was changed if a build is invalidated for this reason.

Note that this optimization does not apply to plugins using the watchDirs return value because those paths are only specified at the directory level and do not describe individual directory entries. You can use watchFiles or watchDirs on the individual entries inside the directory to get a similar effect instead.

Disallow certain uses of < in .mts and .cts files

The upcoming version 4.5 of TypeScript is introducing the .mts and .cts extensions that turn into the .mjs and .cjs extensions when compiled. However, unlike the existing .ts and .tsx extensions, expressions that start with < are disallowed when they would be ambiguous depending on whether they are parsed in .ts or .tsx mode. The ambiguity is caused by the overlap between the syntax for JSX elements and the old deprecated syntax for type casts:

Syntax	`.ts`	`.tsx`	`.mts`/`.cts`
`<x>y`	✅ Type cast	🚫 Syntax error	🚫 Syntax error
`<T>() => {}`	✅ Arrow function	🚫 Syntax error	🚫 Syntax error
`<x>y</x>`	🚫 Syntax error	✅ JSX element	🚫 Syntax error
`<T>() => {}</T>`	🚫 Syntax error	✅ JSX element	🚫 Syntax error
`<T extends>() => {}</T>`	🚫 Syntax error	✅ JSX element	🚫 Syntax error
`<T extends={0}>() => {}</T>`	🚫 Syntax error	✅ JSX element	🚫 Syntax error
`<T,>() => {}`	✅ Arrow function	✅ Arrow function	✅ Arrow function
`<T extends X>() => {}`	✅ Arrow function	✅ Arrow function	✅ Arrow function

This release of esbuild introduces a syntax error for these ambiguous syntax constructs in .mts and .cts files to match the new behavior of the TypeScript compiler.

Do not remove empty @keyframes rules (#1665)

CSS minification in esbuild automatically removes empty CSS rules, since they have no effect. However, empty @keyframes rules still trigger JavaScript animation events so it's incorrect to remove them. To demonstrate that empty @keyframes rules still have an effect, here is a bug report for Firefox where it was incorrectly not triggering JavaScript animation events for empty @keyframes rules: https://bugzilla.mozilla.org/show_bug.cgi?id=1004377.

With this release, empty @keyframes rules are now preserved during minification:
```
/* Original CSS */
@&#8203;keyframes foo {
  from {}
  to {}
}

/* Old output (with --minify) */

/* New output (with --minify) */
@&#8203;keyframes foo{}
```
This fix was contributed by @eelco.
Fix an incorrect duplicate label error (#1671)

When labeling a statement in JavaScript, the label must be unique within the enclosing statements since the label determines the jump target of any labeled break or continue statement:
```
// This code is valid
x: y: z: break x;

// This code is invalid
x: y: x: break x;
```
However, an enclosing label with the same name is allowed as long as it's located in a different function body. Since break and continue statements can't jump across function boundaries, the label is not ambiguous. This release fixes a bug where esbuild incorrectly treated this valid code as a syntax error:
```
// This code is valid, but was incorrectly considered a syntax error
x: (() => {
  x: break x;
})();
```
This fix was contributed by @nevkontakte.

Configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box.

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [esbuild](https://github.com/evanw/esbuild) | devDependencies | patch | [`0.13.4` -> `0.13.7`](https://renovatebot.com/diffs/npm/esbuild/0.13.4/0.13.7) | --- ### Release Notes <details> <summary>evanw/esbuild</summary> ### [`v0.13.7`](https://github.com/evanw/esbuild/blob/master/CHANGELOG.md#0137) [Compare Source](https://github.com/evanw/esbuild/compare/v0.13.6...v0.13.7) - Minify CSS alpha values correctly ([#1682](https://github.com/evanw/esbuild/issues/1682)) When esbuild uses the `rgba()` syntax for a color instead of the 8-character hex code (e.g. when `target` is set to Chrome 61 or earlier), the 0-to-255 integer alpha value must be printed as a floating-point fraction between 0 and 1. The fraction was only printed to three decimal places since that is the minimal number of decimal places required for all 256 different alpha values to be uniquely determined. However, using three decimal places does not necessarily result in the shortest result. For example, `128 / 255` is `0.5019607843137255` which is printed as `".502"` using three decimal places, but `".5"` is equivalent because `round(0.5 * 255) == 128`, so printing `".5"` would be better. With this release, esbuild will always use the minimal numeric representation for the alpha value: ```css /* Original code */ a { color: #FF800080 } /* Old output (with --minify --target=chrome61) */ a{color:rgba(255,128,0,.502)} /* New output (with --minify --target=chrome61) */ a{color:rgba(255,128,0,.5)} ``` - Match node's behavior for core module detection ([#1680](https://github.com/evanw/esbuild/issues/1680)) Node has a hard-coded list of core modules (e.g. `fs`) that, when required, short-circuit the module resolution algorithm and instead return the corresponding internal core module object. When you pass `--platform=node` to esbuild, esbuild also implements this short-circuiting behavior and doesn't try to bundle these import paths. This was implemented in esbuild using the existing `external` feature (e.g. essentially `--external:fs`). However, there is an edge case where esbuild's `external` feature behaved differently than node. Modules specified via esbuild's `external` feature also cause all sub-paths to be excluded as well, so for example `--external:foo` excludes both `foo` and `foo/bar` from the bundle. However, node's core module check is only an exact equality check, so for example `fs` is a core module and bypasses the module resolution algorithm but `fs/foo` is not a core module and causes the module resolution algorithm to search the file system. This behavior can be used to load a module on the file system with the same name as one of node's core modules. For example, `require('fs/')` will load the module `fs` from the file system instead of loading node's core `fs` module. With this release, esbuild will now match node's behavior in this edge case. This means the external modules that are automatically added by `--platform=node` now behave subtly differently than `--external:`, which allows code that relies on this behavior to be bundled correctly. - Fix WebAssembly builds on Go 1.17.2+ ([#1684](https://github.com/evanw/esbuild/pull/1684)) Go 1.17.2 introduces a change (specifically a [fix for CVE-2021-38297](https://go-review.googlesource.com/c/go/+/354591/)) that causes Go's WebAssembly bootstrap script to throw an error when it's run in situations with many environment variables. One such situation is when the bootstrap script is run inside [GitHub Actions](https://github.com/features/actions). This change was introduced because the bootstrap script writes a copy of the environment variables into WebAssembly memory without any bounds checking, and writing more than 4096 bytes of data ends up writing past the end of the buffer and overwriting who-knows-what. So throwing an error in this situation is an improvement. However, this breaks esbuild which previously (at least seemingly) worked fine. With this release, esbuild's WebAssembly bootstrap script that calls out to Go's WebAssembly bootstrap script will now delete all environment variables except for the ones that esbuild checks for, of which there are currently only four: `NO_COLOR`, `NODE_PATH`, `npm_config_user_agent`, and `WT_SESSION`. This should avoid a crash when esbuild is built using Go 1.17.2+ and should reduce the likelihood of memory corruption when esbuild is built using Go 1.17.1 or earlier. This release also updates the Go version that esbuild ships with to version 1.17.2. Note that this problem only affects the `esbuild-wasm` package. The `esbuild` package is not affected. See also: - https://github.com/golang/go/issues/48797 - https://github.com/golang/go/issues/49011 ### [`v0.13.6`](https://github.com/evanw/esbuild/blob/master/CHANGELOG.md#0136) [Compare Source](https://github.com/evanw/esbuild/compare/v0.13.5...v0.13.6) - Emit decorators for `declare` class fields ([#1675](https://github.com/evanw/esbuild/issues/1675)) In version 3.7, TypeScript introduced the `declare` keyword for class fields that avoids generating any code for that field: ```ts // TypeScript input class Foo { a: number declare b: number } // JavaScript output class Foo { a; } ``` However, it turns out that TypeScript still emits decorators for these omitted fields. With this release, esbuild will now do this too: ```ts // TypeScript input class Foo { @decorator a: number; @decorator declare b: number; } // Old JavaScript output class Foo { a; } __decorateClass([ decorator ], Foo.prototype, "a", 2); // New JavaScript output class Foo { a; } __decorateClass([ decorator ], Foo.prototype, "a", 2); __decorateClass([ decorator ], Foo.prototype, "b", 2); ``` - Experimental support for esbuild on NetBSD ([#1624](https://github.com/evanw/esbuild/pull/1624)) With this release, esbuild now has a published binary executable for [NetBSD](https://www.netbsd.org/) in the [`esbuild-netbsd-64`](https://www.npmjs.com/package/esbuild-netbsd-64) npm package, and esbuild's installer has been modified to attempt to use it when on NetBSD. Hopefully this makes installing esbuild via npm work on NetBSD. This change was contributed by [@gdt](https://github.com/gdt). ⚠️ Note: NetBSD is not one of [Node's supported platforms](https://nodejs.org/api/process.html#process_process_platform), so installing esbuild may or may not work on NetBSD depending on how Node has been patched. This is not a problem with esbuild. ⚠️ - Disable the "esbuild was bundled" warning if `ESBUILD_BINARY_PATH` is provided ([#1678](https://github.com/evanw/esbuild/pull/1678)) The `ESBUILD_BINARY_PATH` environment variable allows you to substitute an alternate binary executable for esbuild's JavaScript API. This is useful in certain cases such as when debugging esbuild. The JavaScript API has some code that throws an error if it detects that it was bundled before being run, since bundling prevents esbuild from being able to find the path to its binary executable. However, that error is unnecessary if `ESBUILD_BINARY_PATH` is present because an alternate path has been provided. This release disables the warning when `ESBUILD_BINARY_PATH` is present so that esbuild can be used when bundled as long as you also manually specify `ESBUILD_BINARY_PATH`. This change was contributed by [@heypiotr](https://github.com/heypiotr). - Remove unused `catch` bindings when minifying ([#1660](https://github.com/evanw/esbuild/pull/1660)) With this release, esbuild will now remove unused `catch` bindings when minifying: ```js // Original code try { throw 0; } catch (e) { } // Old output (with --minify) try{throw 0}catch(t){} // New output (with --minify) try{throw 0}catch{} ``` This takes advantage of the new [optional catch binding](https://github.com/tc39/proposal-optional-catch-binding) syntax feature that was introduced in ES2019. This minification rule is only enabled when optional catch bindings are supported by the target environment. Specifically, it's not enabled when using `--target=es2018` or older. Make sure to set esbuild's `target` setting correctly when minifying if the code will be running in an older JavaScript environment. This change was contributed by [@sapphi-red](https://github.com/sapphi-red). ### [`v0.13.5`](https://github.com/evanw/esbuild/blob/master/CHANGELOG.md#0135) [Compare Source](https://github.com/evanw/esbuild/compare/v0.13.4...v0.13.5) - Improve watch mode accuracy ([#1113](https://github.com/evanw/esbuild/issues/1113)) Watch mode is enabled by `--watch` and causes esbuild to become a long-running process that automatically rebuilds output files when input files are changed. It's implemented by recording all calls to esbuild's internal file system interface and then invalidating the build whenever these calls would return different values. For example, a call to esbuild's internal `ReadFile()` function is considered to be different if either the presence of the file has changed (e.g. the file didn't exist before but now exists) or the presence of the file stayed the same but the content of the file has changed. Previously esbuild's watch mode operated at the `ReadFile()` and `ReadDirectory()` level. When esbuild checked whether a directory entry existed or not (e.g. whether a directory contains a `node_modules` subdirectory or a `package.json` file), it called `ReadDirectory()` which then caused the build to depend on that directory's set of entries. This meant the build would be invalidated even if a new unrelated entry was added or removed, since that still changes the set of entries. This is problematic when using esbuild in environments that constantly create and destroy temporary directory entries in your project directory. In that case, esbuild's watch mode would constantly rebuild as the directory was constantly considered to be dirty. With this release, watch mode now operates at the `ReadFile()` and `ReadDirectory().Get()` level. So when esbuild checks whether a directory entry exists or not, the build should now only depend on the presence status for that one directory entry. This should avoid unnecessary rebuilds due to unrelated directory entries being added or removed. The log messages generated using `--watch` will now also mention the specific directory entry whose presence status was changed if a build is invalidated for this reason. Note that this optimization does not apply to plugins using the `watchDirs` return value because those paths are only specified at the directory level and do not describe individual directory entries. You can use `watchFiles` or `watchDirs` on the individual entries inside the directory to get a similar effect instead. - Disallow certain uses of `<` in `.mts` and `.cts` files The upcoming version 4.5 of TypeScript is introducing the `.mts` and `.cts` extensions that turn into the `.mjs` and `.cjs` extensions when compiled. However, unlike the existing `.ts` and `.tsx` extensions, expressions that start with `<` are disallowed when they would be ambiguous depending on whether they are parsed in `.ts` or `.tsx` mode. The ambiguity is caused by the overlap between the syntax for JSX elements and the old deprecated syntax for type casts: | Syntax | `.ts` | `.tsx` | `.mts`/`.cts` | |-------------------------------|----------------------|------------------|----------------------| | `<x>y` | ✅ Type cast | 🚫 Syntax error | 🚫 Syntax error | | `<T>() => {}` | ✅ Arrow function | 🚫 Syntax error | 🚫 Syntax error | | `<x>y</x>` | 🚫 Syntax error | ✅ JSX element | 🚫 Syntax error | | `<T>() => {}</T>` | 🚫 Syntax error | ✅ JSX element | 🚫 Syntax error | | `<T extends>() => {}</T>` | 🚫 Syntax error | ✅ JSX element | 🚫 Syntax error | | `<T extends={0}>() => {}</T>` | 🚫 Syntax error | ✅ JSX element | 🚫 Syntax error | | `<T,>() => {}` | ✅ Arrow function | ✅ Arrow function | ✅ Arrow function | | `<T extends X>() => {}` | ✅ Arrow function | ✅ Arrow function | ✅ Arrow function | This release of esbuild introduces a syntax error for these ambiguous syntax constructs in `.mts` and `.cts` files to match the new behavior of the TypeScript compiler. - Do not remove empty `@keyframes` rules ([#1665](https://github.com/evanw/esbuild/issues/1665)) CSS minification in esbuild automatically removes empty CSS rules, since they have no effect. However, empty `@keyframes` rules still trigger JavaScript animation events so it's incorrect to remove them. To demonstrate that empty `@keyframes` rules still have an effect, here is a bug report for Firefox where it was incorrectly not triggering JavaScript animation events for empty `@keyframes` rules: https://bugzilla.mozilla.org/show_bug.cgi?id=1004377. With this release, empty `@keyframes` rules are now preserved during minification: ```css /* Original CSS */ @keyframes foo { from {} to {} } /* Old output (with --minify) */ /* New output (with --minify) */ @keyframes foo{} ``` This fix was contributed by [@eelco](https://github.com/eelco). - Fix an incorrect duplicate label error ([#1671](https://github.com/evanw/esbuild/pull/1671)) When labeling a statement in JavaScript, the label must be unique within the enclosing statements since the label determines the jump target of any labeled `break` or `continue` statement: ```js // This code is valid x: y: z: break x; // This code is invalid x: y: x: break x; ``` However, an enclosing label with the same name *is* allowed as long as it's located in a different function body. Since `break` and `continue` statements can't jump across function boundaries, the label is not ambiguous. This release fixes a bug where esbuild incorrectly treated this valid code as a syntax error: ```js // This code is valid, but was incorrectly considered a syntax error x: (() => { x: break x; })(); ``` This fix was contributed by [@nevkontakte](https://github.com/nevkontakte). </details> --- ### Configuration 📅 **Schedule**: At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box. --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate added the

dependencies

label 2021-10-15 23:02:28 +00:00

renovate force-pushed renovate/esbuild-0.x from a25908e68b to 6984c099aa

2021-10-16 08:02:33 +00:00

Compare

renovate force-pushed renovate/esbuild-0.x from 6984c099aa to 8474c8a38f

2021-10-16 10:03:35 +00:00

Compare

konrad merged commit fc320d0067 into main

2021-10-16 10:38:03 +00:00

konrad deleted branch renovate/esbuild-0.x