Bump esbuild from 0.16.14 to 0.17.4 #347

Closed

dependabot[bot] wants to merge 1 commit from dependabot/npm_and_yarn/esbuild-0.17.4 into master

dependabot[bot] commented

2023-01-23 11:06:35 +01:00

(Migrated from github.com)

Bumps esbuild from 0.16.14 to 0.17.4.

Release notes

Sourced from esbuild's releases.

v0.17.4
Implement HTTP HEAD requests in serve mode (#2851)

Previously esbuild's serve mode only responded to HTTP GET requests. With this release, esbuild's serve mode will also respond to HTTP HEAD requests, which are just like HTTP GET requests except that the body of the response is omitted.

Permit top-level await in dead code branches (#2853)

Adding top-level await to a file has a few consequences with esbuild:

It causes esbuild to assume that the input module format is ESM, since top-level await is only syntactically valid in ESM. That prevents you from using module and exports for exports and also enables strict mode, which disables certain syntax and changes how function hoisting works (among other things).

This will cause esbuild to fail the build if either top-level await isn't supported by your language target (e.g. it's not supported in ES2021) or if top-level await isn't supported by the chosen output format (e.g. it's not supported with CommonJS).

Doing this will prevent you from using require() on this file or on any file that imports this file (even indirectly), since the require() function doesn't return a promise and so can't represent top-level await.

This release relaxes these rules slightly: rules 2 and 3 will now no longer apply when esbuild has identified the code branch as dead code, such as when it's behind an if (false) check. This should make it possible to use esbuild to convert code into different output formats that only uses top-level await conditionally. This release does not relax rule 1. Top-level await will still cause esbuild to unconditionally consider the input module format to be ESM, even when the top-level await is in a dead code branch. This is necessary because whether the input format is ESM or not affects the whole file, not just the dead code branch.

Fix entry points where the entire file name is the extension (#2861)

Previously if you passed esbuild an entry point where the file extension is the entire file name, esbuild would use the parent directory name to derive the name of the output file. For example, if you passed esbuild a file ./src/.ts then the output name would be src.js. This bug happened because esbuild first strips the file extension to get ./src/ and then joins the path with the working directory to get the absolute path (e.g. join("/working/dir", "./src/") gives /working/dir/src). However, the join operation also canonicalizes the path which strips the trailing /. Later esbuild uses the "base name" operation to extract the name of the output file. Since there is no trailing /, esbuild returns "src" as the base name instead of "", which causes esbuild to incorrectly include the directory name in the output file name. This release fixes this bug by deferring the stripping of the file extension until after all path manipulations have been completed. So now the file ./src/.ts will generate an output file named .js.
Support replacing property access expressions with inject

At a high level, this change means the inject feature can now replace all of the same kinds of names as the define feature. So inject is basically now a more powerful version of define, instead of previously only being able to do some of the things that define could do.

Soem background is necessary to understand this change if you aren't already familiar with the inject feature. The inject feature lets you replace references to global variable with a shim. It works like this:

Put the shim in its own file

Export the shim as the name of the global variable you intend to replace

Pass the file to esbuild using the inject feature

For example, if you inject the following file using --inject:./injected.js:
// injected.js
let processShim = { cwd: () => '/' }
export { processShim as process }
Then esbuild will replace all references to process with the processShim variable, which will cause process.cwd() to return '/'. This feature is sort of abusing the ESM export alias syntax to specify the mapping of global variables to shims. But esbuild works this way because using this syntax for that purpose is convenient and terse.

However, if you wanted to replace a property access expression, the process was more complicated and not as nice. You would have to:

Put the shim in its own file

Export the shim as some random name

Pass the file to esbuild using the inject feature

Use esbuild's define feature to map the property access expression to the random name you made in step 2

For example, if you inject the following file using --inject:./injected2.js --define:process.cwd=someRandomName:
// injected2.js

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.17.4
Implement HTTP HEAD requests in serve mode (#2851)

Previously esbuild's serve mode only responded to HTTP GET requests. With this release, esbuild's serve mode will also respond to HTTP HEAD requests, which are just like HTTP GET requests except that the body of the response is omitted.

Permit top-level await in dead code branches (#2853)

Adding top-level await to a file has a few consequences with esbuild:

It causes esbuild to assume that the input module format is ESM, since top-level await is only syntactically valid in ESM. That prevents you from using module and exports for exports and also enables strict mode, which disables certain syntax and changes how function hoisting works (among other things).

This will cause esbuild to fail the build if either top-level await isn't supported by your language target (e.g. it's not supported in ES2021) or if top-level await isn't supported by the chosen output format (e.g. it's not supported with CommonJS).

Doing this will prevent you from using require() on this file or on any file that imports this file (even indirectly), since the require() function doesn't return a promise and so can't represent top-level await.

This release relaxes these rules slightly: rules 2 and 3 will now no longer apply when esbuild has identified the code branch as dead code, such as when it's behind an if (false) check. This should make it possible to use esbuild to convert code into different output formats that only uses top-level await conditionally. This release does not relax rule 1. Top-level await will still cause esbuild to unconditionally consider the input module format to be ESM, even when the top-level await is in a dead code branch. This is necessary because whether the input format is ESM or not affects the whole file, not just the dead code branch.

Fix entry points where the entire file name is the extension (#2861)

Previously if you passed esbuild an entry point where the file extension is the entire file name, esbuild would use the parent directory name to derive the name of the output file. For example, if you passed esbuild a file ./src/.ts then the output name would be src.js. This bug happened because esbuild first strips the file extension to get ./src/ and then joins the path with the working directory to get the absolute path (e.g. join("/working/dir", "./src/") gives /working/dir/src). However, the join operation also canonicalizes the path which strips the trailing /. Later esbuild uses the "base name" operation to extract the name of the output file. Since there is no trailing /, esbuild returns "src" as the base name instead of "", which causes esbuild to incorrectly include the directory name in the output file name. This release fixes this bug by deferring the stripping of the file extension until after all path manipulations have been completed. So now the file ./src/.ts will generate an output file named .js.
Support replacing property access expressions with inject

At a high level, this change means the inject feature can now replace all of the same kinds of names as the define feature. So inject is basically now a more powerful version of define, instead of previously only being able to do some of the things that define could do.

Soem background is necessary to understand this change if you aren't already familiar with the inject feature. The inject feature lets you replace references to global variable with a shim. It works like this:

Put the shim in its own file

Export the shim as the name of the global variable you intend to replace

Pass the file to esbuild using the inject feature

For example, if you inject the following file using --inject:./injected.js:
// injected.js
let processShim = { cwd: () => '/' }
export { processShim as process }
Then esbuild will replace all references to process with the processShim variable, which will cause process.cwd() to return '/'. This feature is sort of abusing the ESM export alias syntax to specify the mapping of global variables to shims. But esbuild works this way because using this syntax for that purpose is convenient and terse.

However, if you wanted to replace a property access expression, the process was more complicated and not as nice. You would have to:

Put the shim in its own file

Export the shim as some random name

Pass the file to esbuild using the inject feature

Use esbuild's define feature to map the property access expression to the random name you made in step 2

For example, if you inject the following file using --inject:./injected2.js --define:process.cwd=someRandomName:

... (truncated)

Commits

3c83a84 publish 0.17.4 to npm
2252232 support replacing dot identifier names with inject
1f99267 add test for inject + define
6c25c9e fix #2861: bug with extension-only entry points
5fe2125 fix #2853: permit top-level await in dead code
f48391a fix #2851: implement HTTP HEAD requests
7c0526e js tests: convert fetch header to named argument
31fb452 optimizer: mark some new Date expressions pure
acc5bec publish 0.17.3 to npm
f8c5139 fix #2838: bugs due to typos in the css minifier
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [esbuild](https://github.com/evanw/esbuild) from 0.16.14 to 0.17.4. <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>. <blockquote> <h2>v0.17.4</h2> <ul> <li> Implement HTTP <code>HEAD</code> requests in serve mode (<a href="https://github-redirect.dependabot.com/evanw/esbuild/issues/2851">#2851</a>) Previously esbuild's serve mode only responded to HTTP <code>GET</code> requests. With this release, esbuild's serve mode will also respond to HTTP <code>HEAD</code> requests, which are just like HTTP <code>GET</code> requests except that the body of the response is omitted. </li> <li> Permit top-level await in dead code branches (<a href="https://github-redirect.dependabot.com/evanw/esbuild/issues/2853">#2853</a>) Adding top-level await to a file has a few consequences with esbuild: <ol> <li>It causes esbuild to assume that the input module format is ESM, since top-level await is only syntactically valid in ESM. That prevents you from using <code>module</code> and <code>exports</code> for exports and also enables strict mode, which disables certain syntax and changes how function hoisting works (among other things).</li> <li>This will cause esbuild to fail the build if either top-level await isn't supported by your language target (e.g. it's not supported in ES2021) or if top-level await isn't supported by the chosen output format (e.g. it's not supported with CommonJS).</li> <li>Doing this will prevent you from using <code>require()</code> on this file or on any file that imports this file (even indirectly), since the <code>require()</code> function doesn't return a promise and so can't represent top-level await.</li> </ol> This release relaxes these rules slightly: rules 2 and 3 will now no longer apply when esbuild has identified the code branch as dead code, such as when it's behind an <code>if (false)</code> check. This should make it possible to use esbuild to convert code into different output formats that only uses top-level await conditionally. This release does not relax rule 1. Top-level await will still cause esbuild to unconditionally consider the input module format to be ESM, even when the top-level <code>await</code> is in a dead code branch. This is necessary because whether the input format is ESM or not affects the whole file, not just the dead code branch. </li> <li> Fix entry points where the entire file name is the extension (<a href="https://github-redirect.dependabot.com/evanw/esbuild/issues/2861">#2861</a>) Previously if you passed esbuild an entry point where the file extension is the entire file name, esbuild would use the parent directory name to derive the name of the output file. For example, if you passed esbuild a file <code>./src/.ts</code> then the output name would be <code>src.js</code>. This bug happened because esbuild first strips the file extension to get <code>./src/</code> and then joins the path with the working directory to get the absolute path (e.g. <code>join("/working/dir", "./src/")</code> gives <code>/working/dir/src</code>). However, the join operation also canonicalizes the path which strips the trailing <code>/</code>. Later esbuild uses the "base name" operation to extract the name of the output file. Since there is no trailing <code>/</code>, esbuild returns <code>"src"</code> as the base name instead of <code>""</code>, which causes esbuild to incorrectly include the directory name in the output file name. This release fixes this bug by deferring the stripping of the file extension until after all path manipulations have been completed. So now the file <code>./src/.ts</code> will generate an output file named <code>.js</code>. </li> <li> Support replacing property access expressions with inject At a high level, this change means the <code>inject</code> feature can now replace all of the same kinds of names as the <code>define</code> feature. So <code>inject</code> is basically now a more powerful version of <code>define</code>, instead of previously only being able to do some of the things that <code>define</code> could do. Soem background is necessary to understand this change if you aren't already familiar with the <code>inject</code> feature. The <code>inject</code> feature lets you replace references to global variable with a shim. It works like this: <ol> <li>Put the shim in its own file</li> <li>Export the shim as the name of the global variable you intend to replace</li> <li>Pass the file to esbuild using the <code>inject</code> feature</li> </ol> For example, if you inject the following file using <code>--inject:./injected.js</code>: <pre lang="js"><code>// injected.js let processShim = { cwd: () => '/' } export { processShim as process } </code></pre> Then esbuild will replace all references to <code>process</code> with the <code>processShim</code> variable, which will cause <code>process.cwd()</code> to return <code>'/'</code>. This feature is sort of abusing the ESM export alias syntax to specify the mapping of global variables to shims. But esbuild works this way because using this syntax for that purpose is convenient and terse. However, if you wanted to replace a property access expression, the process was more complicated and not as nice. You would have to: <ol> <li>Put the shim in its own file</li> <li>Export the shim as some random name</li> <li>Pass the file to esbuild using the <code>inject</code> feature</li> <li>Use esbuild's <code>define</code> feature to map the property access expression to the random name you made in step 2</li> </ol> For example, if you inject the following file using <code>--inject:./injected2.js --define:process.cwd=someRandomName</code>: <pre lang="js"><code>// injected2.js </code></pre> </li> </ul>  </blockquote> ... (truncated) </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's changelog</a>. <blockquote> <h2>0.17.4</h2> <ul> <li> Implement HTTP <code>HEAD</code> requests in serve mode (<a href="https://github-redirect.dependabot.com/evanw/esbuild/issues/2851">#2851</a>) Previously esbuild's serve mode only responded to HTTP <code>GET</code> requests. With this release, esbuild's serve mode will also respond to HTTP <code>HEAD</code> requests, which are just like HTTP <code>GET</code> requests except that the body of the response is omitted. </li> <li> Permit top-level await in dead code branches (<a href="https://github-redirect.dependabot.com/evanw/esbuild/issues/2853">#2853</a>) Adding top-level await to a file has a few consequences with esbuild: <ol> <li>It causes esbuild to assume that the input module format is ESM, since top-level await is only syntactically valid in ESM. That prevents you from using <code>module</code> and <code>exports</code> for exports and also enables strict mode, which disables certain syntax and changes how function hoisting works (among other things).</li> <li>This will cause esbuild to fail the build if either top-level await isn't supported by your language target (e.g. it's not supported in ES2021) or if top-level await isn't supported by the chosen output format (e.g. it's not supported with CommonJS).</li> <li>Doing this will prevent you from using <code>require()</code> on this file or on any file that imports this file (even indirectly), since the <code>require()</code> function doesn't return a promise and so can't represent top-level await.</li> </ol> This release relaxes these rules slightly: rules 2 and 3 will now no longer apply when esbuild has identified the code branch as dead code, such as when it's behind an <code>if (false)</code> check. This should make it possible to use esbuild to convert code into different output formats that only uses top-level await conditionally. This release does not relax rule 1. Top-level await will still cause esbuild to unconditionally consider the input module format to be ESM, even when the top-level <code>await</code> is in a dead code branch. This is necessary because whether the input format is ESM or not affects the whole file, not just the dead code branch. </li> <li> Fix entry points where the entire file name is the extension (<a href="https://github-redirect.dependabot.com/evanw/esbuild/issues/2861">#2861</a>) Previously if you passed esbuild an entry point where the file extension is the entire file name, esbuild would use the parent directory name to derive the name of the output file. For example, if you passed esbuild a file <code>./src/.ts</code> then the output name would be <code>src.js</code>. This bug happened because esbuild first strips the file extension to get <code>./src/</code> and then joins the path with the working directory to get the absolute path (e.g. <code>join("/working/dir", "./src/")</code> gives <code>/working/dir/src</code>). However, the join operation also canonicalizes the path which strips the trailing <code>/</code>. Later esbuild uses the "base name" operation to extract the name of the output file. Since there is no trailing <code>/</code>, esbuild returns <code>"src"</code> as the base name instead of <code>""</code>, which causes esbuild to incorrectly include the directory name in the output file name. This release fixes this bug by deferring the stripping of the file extension until after all path manipulations have been completed. So now the file <code>./src/.ts</code> will generate an output file named <code>.js</code>. </li> <li> Support replacing property access expressions with inject At a high level, this change means the <code>inject</code> feature can now replace all of the same kinds of names as the <code>define</code> feature. So <code>inject</code> is basically now a more powerful version of <code>define</code>, instead of previously only being able to do some of the things that <code>define</code> could do. Soem background is necessary to understand this change if you aren't already familiar with the <code>inject</code> feature. The <code>inject</code> feature lets you replace references to global variable with a shim. It works like this: <ol> <li>Put the shim in its own file</li> <li>Export the shim as the name of the global variable you intend to replace</li> <li>Pass the file to esbuild using the <code>inject</code> feature</li> </ol> For example, if you inject the following file using <code>--inject:./injected.js</code>: <pre lang="js"><code>// injected.js let processShim = { cwd: () => '/' } export { processShim as process } </code></pre> Then esbuild will replace all references to <code>process</code> with the <code>processShim</code> variable, which will cause <code>process.cwd()</code> to return <code>'/'</code>. This feature is sort of abusing the ESM export alias syntax to specify the mapping of global variables to shims. But esbuild works this way because using this syntax for that purpose is convenient and terse. However, if you wanted to replace a property access expression, the process was more complicated and not as nice. You would have to: <ol> <li>Put the shim in its own file</li> <li>Export the shim as some random name</li> <li>Pass the file to esbuild using the <code>inject</code> feature</li> <li>Use esbuild's <code>define</code> feature to map the property access expression to the random name you made in step 2</li> </ol> For example, if you inject the following file using <code>--inject:./injected2.js --define:process.cwd=someRandomName</code>: <pre lang="js"><code></code></pre> </li> </ul>  </blockquote> ... (truncated) </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/evanw/esbuild/commit/3c83a84d01e22664923b543998b5c03c0c5d8654"><code>3c83a84</code></a> publish 0.17.4 to npm</li> <li><a href="https://github.com/evanw/esbuild/commit/22522328c95203faea1e3fd0ea3a0bd7c285306b"><code>2252232</code></a> support replacing dot identifier names with inject</li> <li><a href="https://github.com/evanw/esbuild/commit/1f992671cddfe749e5b222e690f7c059b505af79"><code>1f99267</code></a> add test for inject + define</li> <li><a href="https://github.com/evanw/esbuild/commit/6c25c9eddf5ffa39757a2a678f505827580656b4"><code>6c25c9e</code></a> fix <a href="https://github-redirect.dependabot.com/evanw/esbuild/issues/2861">#2861</a>: bug with extension-only entry points</li> <li><a href="https://github.com/evanw/esbuild/commit/5fe21253ee75fb4c5ea395a0877b2a5ab51c3575"><code>5fe2125</code></a> fix <a href="https://github-redirect.dependabot.com/evanw/esbuild/issues/2853">#2853</a>: permit top-level await in dead code</li> <li><a href="https://github.com/evanw/esbuild/commit/f48391a1ca8fcfe6659d3ce84fbe5496b2965672"><code>f48391a</code></a> fix <a href="https://github-redirect.dependabot.com/evanw/esbuild/issues/2851">#2851</a>: implement HTTP <code>HEAD</code> requests</li> <li><a href="https://github.com/evanw/esbuild/commit/7c0526e49ba87a0721c87e9c4d241cf730138996"><code>7c0526e</code></a> js tests: convert fetch header to named argument</li> <li><a href="https://github.com/evanw/esbuild/commit/31fb4527134d2fac55d97a48af8f7b0e8ffc3f00"><code>31fb452</code></a> optimizer: mark some <code>new Date</code> expressions pure</li> <li><a href="https://github.com/evanw/esbuild/commit/acc5becf4d4e81473761091fc340efe16325da4a"><code>acc5bec</code></a> publish 0.17.3 to npm</li> <li><a href="https://github.com/evanw/esbuild/commit/f8c51396f763b8a5659920ab35e335cf115b42f4"><code>f8c5139</code></a> fix <a href="https://github-redirect.dependabot.com/evanw/esbuild/issues/2838">#2838</a>: bugs due to typos in the css minifier</li> <li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.16.14...v0.17.4">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=esbuild&package-manager=npm_and_yarn&previous-version=0.16.14&new-version=0.17.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

dependabot[bot] commented

2023-01-30 11:06:31 +01:00

(Migrated from github.com)

Superseded by #349.

Commenting is not possible because the repository is archived.

No reviewers