chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@capsizecss/core	^3.0.0 -> ^3.1.0
@typescript-eslint/eslint-plugin	^5.47.1 -> ^5.52.0
@typescript-eslint/parser	^5.47.1 -> ^5.52.0
c8	^7.12.0 -> ^7.13.0
esbuild	0.16.12 -> 0.17.8
eslint (source)	^8.30.0 -> ^8.34.0
eslint-config-prettier	^8.5.0 -> ^8.6.0
husky (source)	^8.0.2 -> ^8.0.3
lint-staged	^13.1.0 -> ^13.1.2
pnpm (source)	7.21.0 -> 7.27.0
postcss (source)	^8.4.20 -> ^8.4.21
prettier (source)	^2.8.1 -> ^2.8.4
typescript (source)	^4.9.4 -> ^4.9.5
unbuild	^1.0.2 -> ^1.1.2
vite (source)	^4.0.3 -> ^4.1.2
vitest	^0.26.2 -> ^0.28.5

---

Release Notes

seek-oss/capsize

v3.1.0

Compare Source

Minor Changes

• #​117 0e969d8 Thanks @​michaeltaranto! - Add createFontStack for metrics-based font family fallbacks.

  Creates metrics-based @font-face declarations to improve the alignment of font family fallbacks, which can dramatically improve the Cumulative Layout Shift metric for sites that depend on a web font.

Example usage

import { createFontStack } from '@​capsizecss/core';
import lobster from '@​capsizecss/metrics/lobster';
import helveticaNeue from '@​capsizecss/metrics/helveticaNeue';
import arial from '@​capsizecss/metrics/arial';

const { fontFamily, fontFaces } = createFontStack([
  lobster,
  helveticaNeue,
  arial,
]);

The returned values are the computed font family and the generated font face declarations:

// `fontFamily`
"Lobster, 'Lobster Fallback: Helvetica Neue', 'Lobster Fallback: Arial'";

/* `fontFaces` */
@​font-face {
  font-family: 'Lobster Fallback: Helvetica Neue';
  src: local('Helvetica Neue');
  ascent-override: 115.1741%;
  descent-override: 28.7935%;
  size-adjust: 86.8251%;
}
@​font-face {
  font-family: 'Lobster Fallback: Arial';
  src: local('Arial');
  ascent-override: 113.5679%;
  descent-override: 28.392%;
  size-adjust: 88.053%;
}

Patch Changes

• #​122 8a15c86 Thanks @​michaeltaranto! - Add additional properties to FontMetrics type definition.

  Previously the FontMetrics type captured only the metrics required by the options for the createStyleObject and createStyleString APIs.
  With additional APIs coming that require a different subset of metrics, the type now reflects the structure of the data from the metrics package.

  The additional properties are: familyName, category, xHeight and xWidthAvg.
  See documentation for more details.

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v5.52.0

Compare Source

Bug Fixes

• eslint-plugin: [no-import-type-side-effects] correctly ignore zero-specifier imports (#​6444) (d5a6688)
• eslint-plugin: [no-unnecessary-condition] account for optional chaining on potentially void values (#​6432) (e1d9c67), closes #​5255
• eslint-plugin: [no-unnecessary-condition] fix false positive when checking indexed access types (#​6452) (d569924)
• eslint-plugin: fix key-spacing when type starts on next line (#​6412) (3eb2eed)

Features

• eslint-plugin: [block-spacing] extending base rule for TS related blocks (#​6195) (b2db3f5)
• eslint-plugin: [explicit-function-return-type] add allowFunctionsWithoutTypeParameters option (#​6105) (113640e)
• eslint-plugin: [explicit-function-return-type] add allowIIFEs option (#​6237) (a1b3f7b)

v5.51.0

Compare Source

Bug Fixes

• eslint-plugin: [sort-type-constituents] fixed behavior change (#​6384) (5bf7f7f), closes #​6339
• eslint-plugin: do not use .at(), Node 14 does not support it (#​6402) (077ed1b)

Features

• eslint-plugin: [naming-convention] improve performance by removing unnecessary selectors (#​6376) (3647a1c)
• eslint-plugin: [no-floating-promises] error on logical expression (#​6356) (f330e06)
• eslint-plugin: [no-import-type-side-effects] add rule to warn against runtime side effects with verbatimModuleSyntax (#​6394) (b14d3be)
• eslint-plugin: [strict-boolean-expressions] add allow nullable enum to strict boolean expressions (#​6096) (d4747cd)

v5.50.0

Compare Source

Bug Fixes

• eslint-plugin: [ban-ts-comment] counts graphemes instead of String.prototype.length (#​5704) (09d57ce)
• eslint-plugin: [prefer-optional-chain] fix ThisExpression and PrivateIdentifier errors (#​6028) (85e783c)
• eslint-plugin: [prefer-optional-chain] fixer produces wrong logic (#​5919) (b0f6c8e), closes #​1438

Features

• eslint-plugin: add key-spacing rule extension for interface & type declarations (#​6211) (67706e7)

v5.49.0

Compare Source

Features

• eslint-plugin: [naming-convention] add support for #private modifier on class members (#​6259) (c8a6d80)

5.48.2 (2023-01-16)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.48.1 (2023-01-09)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

v5.48.2

Compare Source

Note: Version bump only for package @​typescript-eslint/eslint-plugin

v5.48.1

Compare Source

Note: Version bump only for package @​typescript-eslint/eslint-plugin

v5.48.0

Compare Source

Features

• eslint-plugin: specify which method is unbound and added test case (#​6281) (cf3ffdd)

5.47.1 (2022-12-26)

Bug Fixes

• ast-spec: correct some incorrect ast types (#​6257) (0f3f645)
• eslint-plugin: [member-ordering] correctly invert optionalityOrder (#​6256) (ccd45d4)

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v5.52.0

Compare Source

Note: Version bump only for package @​typescript-eslint/parser

v5.51.0

Compare Source

Note: Version bump only for package @​typescript-eslint/parser

v5.50.0

Compare Source

Note: Version bump only for package @​typescript-eslint/parser

v5.49.0

Compare Source

Note: Version bump only for package @​typescript-eslint/parser

5.48.2 (2023-01-16)

Note: Version bump only for package @​typescript-eslint/parser

5.48.1 (2023-01-09)

Note: Version bump only for package @​typescript-eslint/parser

v5.48.2

Compare Source

Note: Version bump only for package @​typescript-eslint/parser

v5.48.1

Compare Source

Note: Version bump only for package @​typescript-eslint/parser

v5.48.0

Compare Source

Note: Version bump only for package @​typescript-eslint/parser

5.47.1 (2022-12-26)

Note: Version bump only for package @​typescript-eslint/parser

bcoe/c8

v7.13.0

Compare Source

Features

• add skipFull and excludeNodeModules to type definitions (#​417) (b93b9c0)
• support passing reporter options (#​423) (bc347a9)
• types: add typings for reporterOptions (#​446) (3646e6e)

evanw/esbuild

v0.17.8

Compare Source

• Fix a minification bug with non-ASCII identifiers (#​2910)

  This release fixes a bug with esbuild where non-ASCII identifiers followed by a keyword were incorrectly not separated by a space. This bug affected both the in and instanceof keywords. Here's an example of the fix:

  // Original code
  π in a
  
  // Old output (with --minify --charset=utf8)
  πin a;
  
  // New output (with --minify --charset=utf8)
  π in a;

• Fix a regression with esbuild's WebAssembly API in version 0.17.6 (#​2911)

  Version 0.17.6 of esbuild updated the Go toolchain to version 1.20.0. This had the unfortunate side effect of increasing the amount of stack space that esbuild uses (presumably due to some changes to Go's WebAssembly implementation) which could cause esbuild's WebAssembly-based API to crash with a stack overflow in cases where it previously didn't crash. One such case is the package grapheme-splitter which contains code that looks like this:

  if (
    (0x0300 <= code && code <= 0x036F) ||
    (0x0483 <= code && code <= 0x0487) ||
    (0x0488 <= code && code <= 0x0489) ||
    (0x0591 <= code && code <= 0x05BD) ||
    // ... many hundreds of lines later ...
  ) {
    return;
  }

  This edge case involves a chain of binary operators that results in an AST over 400 nodes deep. Normally this wouldn't be a problem because Go has growable call stacks, so the call stack would just grow to be as large as needed. However, WebAssembly byte code deliberately doesn't expose the ability to manipulate the stack pointer, so Go's WebAssembly translation is forced to use the fixed-size WebAssembly call stack. So esbuild's WebAssembly implementation is vulnerable to stack overflow in cases like these.

  It's not unreasonable for this to cause a stack overflow, and for esbuild's answer to this problem to be "don't write code like this." That's how many other AST-manipulation tools handle this problem. However, it's possible to implement AST traversal using iteration instead of recursion to work around limited call stack space. This version of esbuild implements this code transformation for esbuild's JavaScript parser and printer, so esbuild's WebAssembly implementation is now able to process the grapheme-splitter package (at least when compiled with Go 1.20.0 and run with node's WebAssembly implementation).

v0.17.7

Compare Source

• Change esbuild's parsing of TypeScript instantiation expressions to match TypeScript 4.8+ (#​2907)

  This release updates esbuild's implementation of instantiation expression erasure to match microsoft/TypeScript#​49353. The new rules are as follows (copied from TypeScript's PR description):

  When a potential type argument list is followed by

  • a line break,
  • an ( token,
  • a template literal string, or
  • any token except < or > that isn't the start of an expression,

  we consider that construct to be a type argument list. Otherwise we consider the construct to be a < relational expression followed by a > relational expression.

• Ignore sideEffects: false for imported CSS files (#​1370, #​1458, #​2905)

  This release ignores the sideEffects annotation in package.json for CSS files that are imported into JS files using esbuild's css loader. This means that these CSS files are no longer be tree-shaken.

  Importing CSS into JS causes esbuild to automatically create a CSS entry point next to the JS entry point containing the bundled CSS. Previously packages that specified some form of "sideEffects": false could potentially cause esbuild to consider one or more of the JS files on the import path to the CSS file to be side-effect free, which would result in esbuild removing that CSS file from the bundle. This was problematic because the removal of that CSS is outwardly observable, since all CSS is global, so it was incorrect for previous versions of esbuild to tree-shake CSS files imported into JS files.

• Add constant folding for certain additional equality cases (#​2394, #​2895)

  This release adds constant folding for expressions similar to the following:

  // Original input
  console.log(
    null === 'foo',
    null === undefined,
    null == undefined,
    false === 0,
    false == 0,
    1 === true,
    1 == true,
  )
  
  // Old output
  console.log(
    null === "foo",
    null === void 0,
    null == void 0,
    false === 0,
    false == 0,
    1 === true,
    1 == true
  );
  
  // New output
  console.log(
    false,
    false,
    true,
    false,
    true,
    false,
    true
  );

v0.17.6

Compare Source

• Fix a CSS parser crash on invalid CSS (#​2892)

  Previously the following invalid CSS caused esbuild's parser to crash:

  @​media screen

  The crash was caused by trying to construct a helpful error message assuming that there was an opening { token, which is not the case here. This release fixes the crash.

• Inline TypeScript enums that are referenced before their declaration

  Previously esbuild inlined enums within a TypeScript file from top to bottom, which meant that references to TypeScript enum members were only inlined within the same file if they came after the enum declaration. With this release, esbuild will now inline enums even when they are referenced before they are declared:

  // Original input
  export const foo = () => Foo.FOO
  const enum Foo { FOO = 0 }
  
  // Old output (with --tree-shaking=true)
  export const foo = () => Foo.FOO;
  var Foo = /* @​__PURE__ */ ((Foo2) => {
    Foo2[Foo2["FOO"] = 0] = "FOO";
    return Foo2;
  })(Foo || {});
  
  // New output (with --tree-shaking=true)
  export const foo = () => 0 /* FOO */;

  This makes esbuild's TypeScript output smaller and faster when processing code that does this. I noticed this issue when I ran the TypeScript compiler's source code through esbuild's bundler. Now that the TypeScript compiler is going to be bundled with esbuild in the upcoming TypeScript 5.0 release, improvements like this will also improve the TypeScript compiler itself!

• Fix esbuild installation on Arch Linux (#​2785, #​2812, #​2865)

  Someone made an unofficial esbuild package for Linux that adds the ESBUILD_BINARY_PATH=/usr/bin/esbuild environment variable to the user's default environment. This breaks all npm installations of esbuild for users with this unofficial Linux package installed, which has affected many people. Most (all?) people who encounter this problem haven't even installed this unofficial package themselves; instead it was installed for them as a dependency of another Linux package. The problematic change to add the ESBUILD_BINARY_PATH environment variable was reverted in the latest version of this unofficial package. However, old versions of this unofficial package are still there and will be around forever. With this release, ESBUILD_BINARY_PATH is now ignored by esbuild's install script when it's set to the value /usr/bin/esbuild. This should unbreak using npm to install esbuild in these problematic Linux environments.

  Note: The ESBUILD_BINARY_PATH variable is an undocumented way to override the location of esbuild's binary when esbuild's npm package is installed, which is necessary to substitute your own locally-built esbuild binary when debugging esbuild's npm package. It's only meant for very custom situations and should absolutely not be forced on others by default, especially without their knowledge. I may remove the code in esbuild's installer that reads ESBUILD_BINARY_PATH in the future to prevent these kinds of issues. It will unfortunately make debugging esbuild harder. If ESBUILD_BINARY_PATH is ever removed, it will be done in a "breaking change" release.

v0.17.5

Compare Source

• Parse const type parameters from TypeScript 5.0

  The TypeScript 5.0 beta announcement adds const type parameters to the language. You can now add the const modifier on a type parameter of a function, method, or class like this:

  type HasNames = { names: readonly string[] };
  const getNamesExactly = <const T extends HasNames>(arg: T): T["names"] => arg.names;
  const names = getNamesExactly({ names: ["Alice", "Bob", "Eve"] });

  The type of names in the above example is readonly ["Alice", "Bob", "Eve"]. Marking the type parameter as const behaves as if you had written as const at every use instead. The above code is equivalent to the following TypeScript, which was the only option before TypeScript 5.0:

  type HasNames = { names: readonly string[] };
  const getNamesExactly = <T extends HasNames>(arg: T): T["names"] => arg.names;
  const names = getNamesExactly({ names: ["Alice", "Bob", "Eve"] } as const);

  You can read the announcement for more information.

• Make parsing generic async arrow functions more strict in .tsx files

  Previously esbuild's TypeScript parser incorrectly accepted the following code as valid:

  let fn = async <T> () => {};

  The official TypeScript parser rejects this code because it thinks it's the identifier async followed by a JSX element starting with <T>. So with this release, esbuild will now reject this syntax in .tsx files too. You'll now have to add a comma after the type parameter to get generic arrow functions like this to parse in .tsx files:

  let fn = async <T,> () => {};

• Allow the in and out type parameter modifiers on class expressions

  TypeScript 4.7 added the in and out modifiers on the type parameters of classes, interfaces, and type aliases. However, while TypeScript supported them on both class expressions and class statements, previously esbuild only supported them on class statements due to an oversight. This release now allows these modifiers on class expressions too:

  declare let Foo: any;
  Foo = class <in T> { };
  Foo = class <out T> { };

• Update enum constant folding for TypeScript 5.0

  TypeScript 5.0 contains an updated definition of what it considers a constant expression:

  An expression is considered a constant expression if it is

  • a number or string literal,
  • a unary +, -, or ~ applied to a numeric constant expression,
  • a binary +, -, *, /, %, **, <<, >>, >>>, |, &, ^ applied to two numeric constant expressions,
  • a binary + applied to two constant expressions whereof at least one is a string,
  • a template expression where each substitution expression is a constant expression,
  • a parenthesized constant expression,
  • a dotted name (e.g. x.y.z) that references a const variable with a constant expression initializer and no type annotation,
  • a dotted name that references an enum member with an enum literal type, or
  • a dotted name indexed by a string literal (e.g. x.y["z"]) that references an enum member with an enum literal type.

  This impacts esbuild's implementation of TypeScript's const enum feature. With this release, esbuild will now attempt to follow these new rules. For example, you can now initialize an enum member with a template literal expression that contains a numeric constant:

  // Original input
  const enum Example {
    COUNT = 100,
    ERROR = `Expected ${COUNT} items`,
  }
  console.log(
    Example.COUNT,
    Example.ERROR,
  )
  
  // Old output (with --tree-shaking=true)
  var Example = /* @​__PURE__ */ ((Example2) => {
    Example2[Example2["COUNT"] = 100] = "COUNT";
    Example2[Example2["ERROR"] = `Expected ${100 /* COUNT */} items`] = "ERROR";
    return Example2;
  })(Example || {});
  console.log(
    100 /* COUNT */,
    Example.ERROR
  );
  
  // New output (with --tree-shaking=true)
  console.log(
    100 /* COUNT */,
    "Expected 100 items" /* ERROR */
  );

  These rules are not followed exactly due to esbuild's limitations. The rule about dotted references to const variables is not followed both because esbuild's enum processing is done in an isolated module setting and because doing so would potentially require esbuild to use a type system, which it doesn't have. For example:

  // The TypeScript compiler inlines this but esbuild doesn't:
  declare const x = 'foo'
  const enum Foo { X = x }
  console.log(Foo.X)

  Also, the rule that requires converting numbers to a string currently only followed for 32-bit signed integers and non-finite numbers. This is done to avoid accidentally introducing a bug if esbuild's number-to-string operation doesn't exactly match the behavior of a real JavaScript VM. Currently esbuild's number-to-string constant folding is conservative for safety.

• Forbid definite assignment assertion operators on class methods

  In TypeScript, class methods can use the ? optional property operator but not the ! definite assignment assertion operator (while class fields can use both):

  class Foo {
    // These are valid TypeScript
    a?
    b!
    x?() {}
  
    // This is invalid TypeScript
    y!() {}
  }

  Previously esbuild incorrectly allowed the definite assignment assertion operator with class methods. This will no longer be allowed starting with this release.

v0.17.4

Compare Source

• Implement HTTP HEAD requests in serve mode (#​2851)

  Previously esbuild's serve mode only responded to HTTP GET requests. With this release, esbuild's serve mode will also respond to HTTP HEAD requests, which are just like HTTP GET requests except that the body of the response is omitted.

• Permit top-level await in dead code branches (#​2853)

  Adding top-level await to a file has a few consequences with esbuild:

  1. It causes esbuild to assume that the input module format is ESM, since top-level await is only syntactically valid in ESM. That prevents you from using module and exports for exports and also enables strict mode, which disables certain syntax and changes how function hoisting works (among other things).
  2. This will cause esbuild to fail the build if either top-level await isn't supported by your language target (e.g. it's not supported in ES2021) or if top-level await isn't supported by the chosen output format (e.g. it's not supported with CommonJS).
  3. Doing this will prevent you from using require() on this file or on any file that imports this file (even indirectly), since the require() function doesn't return a promise and so can't represent top-level await.

  This release relaxes these rules slightly: rules 2 and 3 will now no longer apply when esbuild has identified the code branch as dead code, such as when it's behind an if (false) check. This should make it possible to use esbuild to convert code into different output formats that only uses top-level await conditionally. This release does not relax rule 1. Top-level await will still cause esbuild to unconditionally consider the input module format to be ESM, even when the top-level await is in a dead code branch. This is necessary because whether the input format is ESM or not affects the whole file, not just the dead code branch.

• Fix entry points where the entire file name is the extension (#​2861)

  Previously if you passed esbuild an entry point where the file extension is the entire file name, esbuild would use the parent directory name to derive the name of the output file. For example, if you passed esbuild a file ./src/.ts then the output name would be src.js. This bug happened because esbuild first strips the file extension to get ./src/ and then joins the path with the working directory to get the absolute path (e.g. join("/working/dir", "./src/") gives /working/dir/src). However, the join operation also canonicalizes the path which strips the trailing /. Later esbuild uses the "base name" operation to extract the name of the output file. Since there is no trailing /, esbuild returns "src" as the base name instead of "", which causes esbuild to incorrectly include the directory name in the output file name. This release fixes this bug by deferring the stripping of the file extension until after all path manipulations have been completed. So now the file ./src/.ts will generate an output file named .js.

• Support replacing property access expressions with inject

  At a high level, this change means the inject feature can now replace all of the same kinds of names as the define feature. So inject is basically now a more powerful version of define, instead of previously only being able to do some of the things that define could do.

  Soem background is necessary to understand this change if you aren't already familiar with the inject feature. The inject feature lets you replace references to global variable with a shim. It works like this:

  1. Put the shim in its own file
  2. Export the shim as the name of the global variable you intend to replace
  3. Pass the file to esbuild using the inject feature

  For example, if you inject the following file using --inject:./injected.js:

  // injected.js
  let processShim = { cwd: () => '/' }
  export { processShim as process }

  Then esbuild will replace all references to process with the processShim variable, which will cause process.cwd() to return '/'. This feature is sort of abusing the ESM export alias syntax to specify the mapping of global variables to shims. But esbuild works this way because using this syntax for that purpose is convenient and terse.

  However, if you wanted to replace a property access expression, the process was more complicated and not as nice. You would have to:

  1. Put the shim in its own file
  2. Export the shim as some random name
  3. Pass the file to esbuild using the inject feature
  4. Use esbuild's define feature to map the property access expression to the random name you made in step 2

  For example, if you inject the following file using --inject:./injected2.js --define:process.cwd=someRandomName:

  // injected2.js
  let cwdShim = () => '/'
  export { cwdShim as someRandomName }

  Then esbuild will replace all references to process.cwd with the cwdShim variable, which will also cause process.cwd() to return '/' (but which this time will not mess with other references to process, which might be desirable).

  With this release, using the inject feature to replace a property access expression is now as simple as using it to replace an identifier. You can now use JavaScript's "arbitrary module namespace identifier names" feature to specify the property access expression directly using a string literal. For example, if you inject the following file using --inject:./injected3.js:

  // injected3.js
  let cwdShim = () => '/'
  export { cwdShim as 'process.cwd' }

  Then esbuild will now replace all references to process.cwd with the cwdShim variable, which will also cause process.cwd() to return '/' (but which will also not mess with other references to process).

  In addition to inserting a shim for a global variable that doesn't exist, another use case is replacing references to static methods on global objects with cached versions to both minify them better and to make access to them potentially faster. For example:

  // Injected file
  let cachedMin = Math.min
  let cachedMax = Math.max
  export {
    cachedMin as 'Math.min',
    cachedMax as 'Math.max',
  }
  
  // Original input
  function clampRGB(r, g, b) {
    return {
      r: Math.max(0, Math.min(1, r)),
      g: Math.max(0, Math.min(1, g)),
      b: Math.max(0, Math.min(1, b)),
    }
  }
  
  // Old output (with --minify)
  function clampRGB(a,t,m){return{r:Math.max(0,Math.min(1,a)),g:Math.max(0,Math.min(1,t)),b:Math.max(0,Math.min(1,m))}}
  
  // New output (with --minify)
  var a=Math.min,t=Math.max;function clampRGB(h,M,m){return{r:t(0,a(1,h)),g:t(0,a(1,M)),b:t(0,a(1,m))}}

v0.17.3

Compare Source

• Fix incorrect CSS minification for certain rules (#​2838)

  Certain rules such as @media could previously be minified incorrectly. Due to a typo in the duplicate rule checker, two known @-rules that share the same hash code were incorrectly considered to be equal. This problem was made worse by the rule hashing code considering two unknown declarations (such as CSS variables) to have the same hash code, which also isn't optimal from a performance perspective. Both of these issues have been fixed:

  /* Original input */
  @​media (prefers-color-scheme: dark) { body { --VAR-1: #​000; } }
  @​media (prefers-color-scheme: dark) { body { --VAR-2: #​000; } }
  
  /* Old output (with --minify) */
  @​media (prefers-color-scheme: dark){body{--VAR-2: #​000}}
  
  /* New output (with --minify) */
  @​media (prefers-color-scheme: dark){body{--VAR-1: #​000}}@​media (prefers-color-scheme: dark){body{--VAR-2: #​000}}

v0.17.2

Compare Source

• Add onDispose to the plugin API (#​2140, #​2205)

  If your plugin wants to perform some cleanup after it's no longer going to be used, you can now use the onDispose API to register a callback for cleanup-related tasks. For example, if a plugin starts a long-running child process then it may want to terminate that process when the plugin is discarded. Previously there was no way to do this. Here's an example:

  let examplePlugin = {
    name: 'example',
    setup(build) {
      build.onDispose(() => {
        console.log('This plugin is no longer used')
      })
    },
  }

  These onDispose callbacks will be called after every build() call regardless of whether the build failed or not as well as after the first dispose() call on a given build context.

v0.17.1

Compare Source

• Make it possible to cancel a build (#​2725)

  The context object introduced in version 0.17.0 has a new cancel() method. You can use it to cancel a long-running build so that you can start a new one without needing to wait for the previous one to finish. When this happens, the previous build should always have at least one error and have no output files (i.e. it will be a failed build).

  Using it might look something like this:

  • JS:

    let ctx = await esbuild.context({
      // ...
    })
    
    let rebuildWithTimeLimit = timeLimit => {
      let timeout = setTimeout(() => ctx.cancel(), timeLimit)
      return ctx.rebuild().finally(() => clearTimeout(timeout))
    }
    
    let build = await rebuildWithTimeLimit(500)

  • Go:

    ctx, err := api.Context(api.BuildOptions{
      // ...
    })
    if err != nil {
      return
    }
    
    rebuildWithTimeLimit := func(timeLimit time.Duration) api.BuildResult {
      t := time.NewTimer(timeLimit)
      go func() {
        <-t.C
        ctx.Cancel()
      }()
      result := ctx.Rebuild()
      t.Stop()
      return result
    }
    
    build := rebuildWithTimeLimit(500 * time.Millisecond)

  This API is a quick implementation and isn't maximally efficient, so the build may continue to do some work for a little bit before stopping. For example, I have added stop points between each top-level phase of the bundler and in the main module graph traversal loop, but I haven't added fine-grained stop points within the internals of the linker. How quickly esbuild stops can be improved in future releases. This means you'll want to wait for cancel() and/or the previous rebuild() to finish (i.e. await the returned promise in JavaScript) before starting a new build, otherwise rebuild() will give you the just-canceled build that still hasn't ended yet. Note that onEnd callbacks will still be run regardless of whether or not the build was canceled.

• Fix server-sent events without servedir (#​2827)

  The server-sent events for live reload were incorrectly using servedir to calculate the path to modified output files. This means events couldn't be sent when servedir wasn't specified. This release uses the internal output directory (which is always present) instead of servedir (which might be omitted), so live reload should now work when servedir is not specified.

• Custom entry point output paths now work with the copy loader (#​2828)

  Entry points can optionally provide custom output paths to change the path of the generated output file. For example, esbuild foo=abc.js bar=xyz.js --outdir=out generates the files out/foo.js and out/bar.js. However, this previously didn't work when using the copy loader due to an oversight. This bug has been fixed. For example, you can now do esbuild foo=abc.html bar=xyz.html --outdir=out --loader:.html=copy to generate the files out/foo.html and out/bar.html.

• The JS API can now take an array of objects (#​2828)

  Previously it was not possible to specify two entry points with the same custom output path using the JS API, although it was possible to do this with the Go API and the CLI. This will not cause a collision if both entry points use different extensions (e.g. if one uses .js and the other uses .css). You can now pass the JS API an array of objects to work around this API limitation:

  // The previous API didn't let you specify duplicate output paths
  let result = await esbuild.build({
    entryPoints: {
      // This object literal contains a duplicate key, so one is ignored
      'dist': 'foo.js',
      'dist': 'bar.css',
    },
  })
  
  // You can now specify duplicate output paths as an array of objects
  let result = await esbuild.build({
    entryPoints: [
      { in: 'foo.js', out: 'dist' },
      { in: 'bar.css', out: 'dist' },
    ],
  })

v0.17.0

Compare Source

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.16.0 or ~0.16.0. See npm's documentation about semver for more information.

At a high level, the breaking changes in this release fix some long-standing issues with the design of esbuild's incremental, watch, and serve APIs. This re

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[socket-security]

Socket Security Pull Request Report

Dependency issues detected: If you merge this pull request, you will not be alerted to the instances of these issues again.

📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package	Script field	Source
esbuild@0.16.17 (upgraded)	postinstall	package.json via vitest@0.28.5
esbuild@0.17.8 (upgraded)	postinstall	package.json via unbuild@1.1.2

Pull request report summary

Issue	Status
Install scripts	⚠️ 2 issues
Native code	✅ 0 issues
Bin script confusion	✅ 0 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@2.4.2

• @SocketSecurity ignore esbuild@0.16.17
• @SocketSecurity ignore esbuild@0.17.8

Powered by socket.dev