privatenumber / tsx

⚡️ TypeScript Execute | The easiest way to run TypeScript in Node.js
https://tsx.is
MIT License
9.77k stars 154 forks source link

fix: upgrade esbuild to 0.24.0 address various issues #669

Closed aquajach closed 1 month ago

aquajach commented 1 month ago

Thanks for maintaining this project!

Read and understood the reason behind closing another PR . But I would still like to submit this one because:

  1. To address multiple vulnerability issues that from golang. Of course, we could override the version of esbuild in our own package.json to work around them, but user experience suffers, especially have impact to new users of tsx who also care about vulnerabilities.
  2. The esbuild release is no longer with breaking change label.
  3. To avoid a potential esbuild-wasm crash coming from a bug in memchr https://github.com/evanw/esbuild/pull/3902
  4. To reduce the warnings mentioned in the earlier PR.
  5. To fix class field decorators in TypeScript if useDefineForClassFields is false (https://github.com/evanw/esbuild/issues/3913)

To be honest, none of them alone solves a critical problem of tsx itself but I hope with all together makes the impact bigger.

We all understand it is a good practice to keep dependencies up to date to a certain level with cautiousness. Comparing to big version jumps, I think smaller incremental hips is less risky for long run, although brings a bit of more work to do from maintainers' point of view.

privatenumber commented 1 month ago

It's marked as a breaking change here: https://github.com/evanw/esbuild/releases/tag/v0.24.0

Unless you can give me a real reason for upgrading than "good practice to stay up to date", I'll be closing these PRs as it creates unnecessary work for me and has no impact on users.

Closing as a duplicate of https://github.com/privatenumber/tsx/pull/664