search

acordiner92 / npm-audit-pipeline

NPM Audit Tool for Pipelines
Apache License 2.0
12 stars 1 forks source link

Bump esbuild from 0.14.54 to 0.16.7 #365

Closed dependabot[bot] closed 1 year ago

dependabot[bot] commented 1 year ago

Bumps esbuild from 0.14.54 to 0.16.7.

Release notes

Sourced from esbuild's releases.

v0.16.7

  • Include file loader strings in metafile imports (#2731)

    Bundling a file with the file loader copies that file to the output directory and imports a module with the path to the copied file in the default export. Previously when bundling with the file loader, there was no reference in the metafile from the JavaScript file containing the path string to the copied file. With this release, there will now be a reference in the metafile in the imports array with the kind file-loader:

     {
   ...
   "outputs": {
     "out/image-55CCFTCE.svg": {
       ...
     },
     "out/entry.js": {
       "imports": [
+        {
+          "path": "out/image-55CCFTCE.svg",
+          "kind": "file-loader"
+        }
       ],
       ...
     }
   }
 }

  • Fix byte counts in metafile regarding references to other output files (#2071)

    Previously files that contained references to other output files had slightly incorrect metadata for the byte counts of input files which contributed to that output file. So for example if app.js imports image.png using the file loader and esbuild generates out.js and image-LSAMBFUD.png, the metadata for how many bytes of out.js are from app.js was slightly off (the metadata for the byte count of out.js was still correct). The reason is because esbuild substitutes the final paths for references between output files toward the end of the build to handle cyclic references, and the byte counts needed to be adjusted as well during the path substitution. This release fixes these byte counts (specifically the bytesInOutput values).

  • The alias feature now strips a trailing slash (#2730)

    People sometimes add a trailing slash to the name of one of node's built-in modules to force node to import from the file system instead of importing the built-in module. For example, importing util imports node's built-in module called util but importing util/ tries to find a package called util on the file system. Previously attempting to use esbuild's package alias feature to replace imports to util with a specific file would fail because the file path would also gain a trailing slash (e.g. mapping util to ./file.js turned util/ into ./file.js/). With this release, esbuild will now omit the path suffix if it's a single trailing slash, which should now allow you to successfully apply aliases to these import paths.

v0.16.6

  • Do not mark subpath imports as external with --packages=external (#2741)

    Node has a feature called subpath imports where special import paths that start with # are resolved using the imports field in the package.json file of the enclosing package. The intent of the newly-added --packages=external setting is to exclude a package's dependencies from the bundle. Since a package's subpath imports are only accessible within that package, it's wrong for them to be affected by --packages=external. This release changes esbuild so that --packages=external no longer affects subpath imports.

  • Forbid invalid numbers in JSON files

    Previously esbuild parsed numbers in JSON files using the same syntax as JavaScript. But starting from this release, esbuild will now parse them with JSON syntax instead. This means the following numbers are no longer allowed by esbuild in JSON files:

    • Legacy octal literals (non-zero integers starting with 0)
    • The 0b, 0o, and 0x numeric prefixes
    • Numbers containing _ such as 1_000
    • Leading and trailing . such as 0. and .0
    • Numbers with a space after the - such as - 1

  • Add external imports to metafile (#905, #1768, #1933, #1939)

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.16.7

  • Include file loader strings in metafile imports (#2731)

    Bundling a file with the file loader copies that file to the output directory and imports a module with the path to the copied file in the default export. Previously when bundling with the file loader, there was no reference in the metafile from the JavaScript file containing the path string to the copied file. With this release, there will now be a reference in the metafile in the imports array with the kind file-loader:

     {
   ...
   "outputs": {
     "out/image-55CCFTCE.svg": {
       ...
     },
     "out/entry.js": {
       "imports": [
+        {
+          "path": "out/image-55CCFTCE.svg",
+          "kind": "file-loader"
+        }
       ],
       ...
     }
   }
 }

  • Fix byte counts in metafile regarding references to other output files (#2071)

    Previously files that contained references to other output files had slightly incorrect metadata for the byte counts of input files which contributed to that output file. So for example if app.js imports image.png using the file loader and esbuild generates out.js and image-LSAMBFUD.png, the metadata for how many bytes of out.js are from app.js was slightly off (the metadata for the byte count of out.js was still correct). The reason is because esbuild substitutes the final paths for references between output files toward the end of the build to handle cyclic references, and the byte counts needed to be adjusted as well during the path substitution. This release fixes these byte counts (specifically the bytesInOutput values).

  • The alias feature now strips a trailing slash (#2730)

    People sometimes add a trailing slash to the name of one of node's built-in modules to force node to import from the file system instead of importing the built-in module. For example, importing util imports node's built-in module called util but importing util/ tries to find a package called util on the file system. Previously attempting to use esbuild's package alias feature to replace imports to util with a specific file would fail because the file path would also gain a trailing slash (e.g. mapping util to ./file.js turned util/ into ./file.js/). With this release, esbuild will now omit the path suffix if it's a single trailing slash, which should now allow you to successfully apply aliases to these import paths.

0.16.6

  • Do not mark subpath imports as external with --packages=external (#2741)

    Node has a feature called subpath imports where special import paths that start with # are resolved using the imports field in the package.json file of the enclosing package. The intent of the newly-added --packages=external setting is to exclude a package's dependencies from the bundle. Since a package's subpath imports are only accessible within that package, it's wrong for them to be affected by --packages=external. This release changes esbuild so that --packages=external no longer affects subpath imports.

  • Forbid invalid numbers in JSON files

    Previously esbuild parsed numbers in JSON files using the same syntax as JavaScript. But starting from this release, esbuild will now parse them with JSON syntax instead. This means the following numbers are no longer allowed by esbuild in JSON files:

    • Legacy octal literals (non-zero integers starting with 0)
    • The 0b, 0o, and 0x numeric prefixes
    • Numbers containing _ such as 1_000
    • Leading and trailing . such as 0. and .0
    • Numbers with a space after the - such as - 1

... (truncated)

Commits
  • be16d81 publish 0.16.7 to npm
  • 0c872cd additional linker comments
  • a375b37 fix #2071: remap bytesInOutput for substitutions
  • 0e12657 fix bugs due to lack of file-private vars in go
  • cd3fdcc move chunks array onto linker
  • eb0e118 metafile coverage for paths between output files
  • 7bf440d fix #2730: alias now strips a trailing slash
  • b0a82d3 fix #2731: put file loader strings in metafile
  • 70c5729 a small js minification improvement
  • ee8e0dd publish 0.16.6 to npm
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 1 year ago

Superseded by #366.