Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr) This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are…
Add support for with { type: 'text' } imports (#4435) The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example: import string from './example.tx…
Fix lowering of define semantics for TypeScript parameter properties (#4421) The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case: // Original code class Foo { constructor(public x = 1) {} y = 2 }…
Fix for an async generator edge case (#4401, #4417) Support for transforming async generators into the equivalent state machine was added in version 0.19.0. However, the generated state machine didn't work correctly when polling async generators concurrently, such as in the following code: async function* inner() { yield 1; yield 2 } async function* outer() { yield* inner() } let gen = outer() for…
Fix a regression with CSS media queries (#4395, #4405, #4406) Version 0.25.11 of esbuild introduced support for parsing media queries. This unintentionally introduced a regression with printing media queries that use the <media-type> and <media-condition-without-or> grammar. Specifically, esbuild was failing to wrap an or clause with parentheses when inside <media-condition-without-or>. This relea…
Preserve URL fragments in data URLs (#4370) Consider the following HTML, CSS, and SVG: index.html: <!DOCTYPE html> <html> <head><link rel="stylesheet" href="icons.css"></head> <body><div class="triangle"></div></body> </html> icons.css: .triangle { width: 10px; height: 10px; background: currentColor; clip-path: url(./triangle.svg#x); } triangle.svg: <svg xmlns="http://www.w3.org/2000/svg"> <defs>…
Allow import path specifiers starting with #/ (#4361) Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_…
Fix bundler bug with var nested inside if (#4348) This release fixes a bug with the bundler that happens when importing an ES module using require (which causes it to be wrapped) and there's a top-level var inside an if statement without being wrapped in a { ... } block (and a few other conditions). The bundling transform needed to hoist these var declarations outside of the lazy ES module wrapper…
This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.26.0 or ~0.26.0. See npm's documentation about semver for more information. Use Uint8Array.fromBase64…
Enable trusted publishing (#4281) GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory. Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this…