Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tiered WebAssembly compilation broken #36616

Closed
Tracked by #2228
mejedi opened this issue Dec 24, 2020 · 33 comments
Closed
Tracked by #2228

tiered WebAssembly compilation broken #36616

mejedi opened this issue Dec 24, 2020 · 33 comments
Labels
v8 platform Issues and PRs related to Node's v8::Platform implementation. wasm Issues and PRs related to WebAssembly.

Comments

@mejedi
Copy link

mejedi commented Dec 24, 2020

  • Version: v16.0.0-pre (903998aced7dbb964ec7567c4b5765888d16b18d)
  • Platform: Darwin DEU0917.local 19.6.0 Darwin Kernel Version 19.6.0: Thu Oct 29 22:56:45 PDT 2020; root:xnu-6153.141.2.2~1/RELEASE_X86_64 x86_64
  • Subsystem: embed_helpers.cc/SpinEventLoop

Trivia: V8 has two tiers of WASM compilation — liftoff and turbofan. Liftoff produces unoptimised code and completes fast. Once it's done, the promise returned from WebAssembly.compile(...) is resolved and the module is ready to run. In meantime, Turbofan continues in the background. It will transparently replace the compiled module code with an optimised version.

Use --trace-wasm-compiler flag to gain some visibility into the process.

What steps will reproduce the bug?

Get a big WASM file (20MiB+). The following snippet assumes that the file is called BIG.wasm:

const fs = require("fs")
const data = fs.readFileSync("BIG.wasm")
WebAssembly.compile(data).then(()=>console.log("module ready"))

How often does it reproduce? Is there a required condition?

Reproduces always if there's nothing registered with the event loop.

What is the expected behavior?

WebAssembly module becomes available shortly while optimised compiler continues in the background.

Works as expected in interactive mode (node --trace-wasm-compiler):

Welcome to Node.js v16.0.0-pre.
Type ".help" for more information.
> const fs = require("fs")
undefined
> const data = fs.readFileSync("BIG.wasm")
undefined
> WebAssembly.compile(data).then(()=>console.log("module ready"))
(1) Decoding module...
Promise { <pending> }
(2) Prepare and start compile...
ExecuteCompilationUnits (task id 0)
Compiling wasm function 21088 with liftoff
ExecuteCompilationUnits (task id 1)
Compiling wasm function 29541 with liftoff
ExecuteCompilationUnits (task id 2)
Compiling wasm function 39979 with liftoff
ExecuteCompilationUnits (task id 3)
Compiling wasm function 791 with liftoff
Compiling wasm function 654 with liftoff
Compiling wasm function 27451 with liftoff
Compiling wasm function 24648 with liftoff
...
(3b) Compilation finished
(4) Finish module...
Compiling wasm function 791 with turbofan
module ready
Compiling wasm function 654 with turbofan
Compiling wasm function 27451 with turbofan
Compiling wasm function 24648 with turbofan
Compiling wasm function 27700 with turbofan
...

What do you see instead?

WebAssembly module doesn't become available until optimising compiler completes. The startup is rather slow.

(1) Decoding module...
(2) Prepare and start compile...
ExecuteCompilationUnits (task id 0)
Compiling wasm function 21088 with liftoff
ExecuteCompilationUnits (task id 1)
Compiling wasm function 29541 with liftoff
ExecuteCompilationUnits (task id 2)
Compiling wasm function 39979 with liftoff
ExecuteCompilationUnits (task id 3)
Compiling wasm function 791 with liftoff
Compiling wasm function 654 with liftoff
Compiling wasm function 27451 with liftoff
Compiling wasm function 24648 with liftoff
...
Compiling wasm function 21088 with turbofan
Compiling wasm function 791 with turbofan
Compiling wasm function 29541 with turbofan
Compiling wasm function 39979 with turbofan
...
(3b) Compilation finished
(4) Finish module...
module ready

Additional information

Main thread is blocked in node::WorkerThreadsTaskRunner::BlockingDrain, waiting for compiler task. BlockingDrain doesn't run the event loop. Apparently there's an assumption that tasks don't communicate with the main thread.

That's wrong. WASM compiler notifies the main thread once baseline compilation is complete (see AsyncCompileJob::CompilationStateCallback, CompilationEvent::kFinishedBaselineCompilation case).

The message goes through WorkerThreadsTaskRunner::DelayedTaskScheduler::PostDelayedTask (node_platform.cc), calling uv_async_send. The later goes unnoticed since BlockingDrain doesn't run the event loop.

  * frame #0: 0x00007fff696fd882 libsystem_kernel.dylib`__psynch_cvwait + 10
    frame #1: 0x00007fff697be425 libsystem_pthread.dylib`_pthread_cond_wait + 698
    frame #2: 0x0000000101394c9d node`uv_cond_wait(cond=0x0000000107517f98, mutex=0x0000000107517f28) at thread.c:780:7
    frame #3: 0x000000010014867d node`node::LibuvMutexTraits::cond_wait(cond=0x0000000107517f98, mutex=0x0000000107517f28) at node_mutex.h:156:5
    frame #4: 0x0000000100148620 node`node::ConditionVariableBase<node::LibuvMutexTraits>::Wait(this=0x0000000107517f98, scoped_lock=0x00007ffeefbff430) at node_mutex.h:194:3
    frame #5: 0x00000001002dfae7 node`node::TaskQueue<v8::Task>::BlockingDrain(this=0x0000000107517f28) at node_platform.cc:603:20
    frame #6: 0x00000001002dfa95 node`node::WorkerThreadsTaskRunner::BlockingDrain(this=0x0000000107517f28) at node_platform.cc:207:25
    frame #7: 0x00000001002e2274 node`node::NodePlatform::DrainTasks(this=0x0000000108808d80, isolate=0x00000001073ec000) at node_platform.cc:441:33
    frame #8: 0x00000001000087fe node`node::SpinEventLoop(env=0x000000010780f800) at embed_helpers.cc:38:17
    frame #9: 0x000000010024cfb2 node`node::NodeMainInstance::Run(this=0x00007ffeefbff6a0, env_info=0x000000010491d6b8) at node_main_instance.cc:144:19
    frame #10: 0x000000010012f28a node`node::Start(argc=3, argv=0x00007ffeefbff850) at node.cc:1078:38
    frame #11: 0x0000000101d1215e node`main(argc=3, argv=0x00007ffeefbff850) at node_main.cc:127:10
    frame #12: 0x00007fff695b9cc9 libdyld.dylib`start + 1
@mejedi
Copy link
Author

mejedi commented Dec 24, 2020

Attaching a large WASM file.
clang-11.wasm.zip

@targos targos added the wasm Issues and PRs related to WebAssembly. label Dec 27, 2020
@targos
Copy link
Member

targos commented Dec 28, 2020

Is this a bug in V8 or in Node.js?

@mejedi
Copy link
Author

mejedi commented Dec 28, 2020

@targos
This is a Node.js bug. If there's anything registered with the event loop, it works as expected. It works in the interactive mode. Also works in non-interactive mode when there is a pending timer (setTimeout).

See Additional information in the bug report for some additional info.

@targos
Copy link
Member

targos commented Dec 28, 2020

I don't know which team to ping for this kind of issues, so let's go with @addaleax who is probably the most familiar with node_platform.cc.

@addaleax addaleax added the v8 platform Issues and PRs related to Node's v8::Platform implementation. label Dec 28, 2020
@mejedi
Copy link
Author

mejedi commented Jan 11, 2021

There are further oddities related to WebAssembly.compile. Piggybacking on the existing issue since these shortcomings are closely related.

const fs = require('fs');

// Workaround #36616
const timerId = setInterval(() => {}, 60000);

process.on('exit', () => {
  console.log(new Date(), 'process exit');
});

process.on('beforeExit', () => {
  console.log(new Date(), 'process beforeExit');
});

WebAssembly.compile(fs.readFileSync('BIG.wasm')).then(() => {
  console.log(new Date(), 'compiled (liftoff)');
  clearInterval(timerId);
  if (process.env.EXPLICIT_EXIT) process.exit();
});

console.log(new Date(), 'WebAssembly.compile()');

Without EXPLICIT_EXIT

Pending WebAssembly.compile should keep event loop running. Once the promise is resolved, event loop should stop (assuming that there's no other ongoing activity).

% time ./out/Release/node bug.js
2021-01-11T12:39:00.828Z WebAssembly.compile()
2021-01-11T12:39:01.369Z compiled (liftoff)
2021-01-11T12:39:12.717Z process beforeExit
2021-01-11T12:39:12.718Z process exit
./out/Release/node bug.js  45.90s user 1.17s system 389% cpu 12.092 total

Event loop keeps going for another ~11 seconds until the module is fully optimised.

With EXPLICIT_EXIT

Node should terminate promptly when process.exit() is called.

% time EXPLICIT_EXIT=1 ./out/Release/node bug.js
2021-01-11T12:43:53.213Z WebAssembly.compile()
2021-01-11T12:43:53.761Z compiled (liftoff)
2021-01-11T12:43:53.762Z process exit
EXPLICIT_EXIT=1 ./out/Release/node bug.js  45.71s user 1.14s system 395% cpu 11.840 total

It took ~11 seconds for process.exit() to be honoured.

@mejedi mejedi changed the title tiered WebAssembly compilation broken (node TaskQueue problem) tiered WebAssembly compilation broken Jan 11, 2021
@evanw
Copy link

evanw commented Jan 25, 2021

I'm working on esbuild and have also encountered this issue, and I believe swc has as well. I think I have a hacky workaround. I'm describing the workaround here in case it's useful to anyone:

  1. Compile the following C code into a shared library for each platform you want to support:

    #include <unistd.h>
    void* napi_register_module_v1(void* a, void* b) {
      _exit(0);
    }
  2. Include all compiled shared libraries in your module, then invoke the shared library for the current platform as a native module:

    process.on('exit', () => require('./exit0-darwin.node'))

Manually compiling the module like this avoids the complexity of node-gyp and should make the shared libraries really small, so it should be reasonable to just include precompiled versions for each supported platform in your package. FWIW.

@devsnek
Copy link
Member

devsnek commented Feb 6, 2021

cc @addaleax @backes as y'all touched this most recently. i looked through this a bit but i'm not entirely sure what should be done. maybe adding a uv_run to the loop in DrainTasks?

@backes
Copy link
Contributor

backes commented Feb 8, 2021

Sorry, I don't know much about the different queues, especially in node. It looks wrong though to have the main task blocked if there is foreground work to be executed. That work can indeed be triggered by background compilation, in which case the main thread should pick it up as soon as possible.

@gahaas anything to add here?

@gahaas
Copy link
Contributor

gahaas commented Feb 8, 2021

It seems to me that BlockingDrain should only execute a single task, not all tasks. As far as I understand, the purpose of DrainTask is to make the main thread help the worker threads while it does not have any work, not to do all the background work. The loop condition should be (per_isolate->FlushForegroundTasksInternal() || Isolate::HasPendingBackgroundTasks()), so that still all background work is done that could potentially spawn foreground work.

@cspotcode
Copy link

Regarding the issue explained here #36616 (comment) where the node process does not terminate until WASM optimization has fully completed:

Is the issue that the WASM compilation task should be aborted instead of completed? I don't know v8 or node internals so I don't know if that theory makes sense or not. Is there a way that tasks are classified as either necessary or unnecessary to complete, so that unnecessary ones are aborted on process.exit()?

Or is the problem that process.on('exit' handlers cannot be invoked as long as the event loop is blocked by BlockingDrain?

@gahaas
Copy link
Contributor

gahaas commented Jun 14, 2021

I think the problem is still what I wrote in the comment above. V8 has foreground tasks and background tasks. Typically background tasks could be ignored completely, they just exist to make V8 faster. For example, the optimizing compiler can be executed on a background task, but if this task is not executed, then V8 can still execute the baseline code. Similarly the garbage collector can be executed on a background task, but if the background task is not executed, then V8 will just stop the main thread and do garbage collection on the main thread. This means also, that when all foreground tasks have finished and only background tasks are left, you can just terminate the node without any issue.

The only case where background tasks are important, and where node should wait for background tasks, is asynchronous compilation of WebAssembly modules. In that case the WebAssembly module gets compiled completely on background tasks, and the last background task will then spawn a foreground task to continue execution on the main thread. This means that if node terminates when no foreground task is available anymore, it would not wait for WebAssembly compilation to finish, and not would potentially not execute an important part of a script.

V8 introduced the API function Isolate::HasPendingBackgroundTasks() to tell the embedder if there is background work that will spawn a foreground task or not. If Isolate::HasPendingBackgroundTasks() returns false, then node can just terminate. But if Isolate::HasPendingBackgroundTasks() returns true, node should also wait for background tasks to finish.

@cspotcode
Copy link

Thank you for the detailed explanation. I was looking at the code to hopefully make a PR based on your recommendation.

Is the following scenario a potential risk? Again, I'm coming in blind so I don't know if this makes sense.

  • 2x background tasks exist, one that will take 5 seconds and one that will take 0.1 seconds.
  • Isolate::HasPendingBackgroundTasks returns true because the 0.1 second task must be completed. (the 5 second task is not important)
  • Main thread picks up the 5 second task instead of the 0.1 second task.

The main thread is stuck for 5 seconds executing work that is not strictly necessary. Is this possible? Is there a correct way to avoid it?

@cspotcode
Copy link

Trying to learn node's internals based on this ticket. I see this looks like where the event loop happens:

do {
if (env->is_stopping()) break;
uv_run(env->event_loop(), UV_RUN_DEFAULT);
if (env->is_stopping()) break;
platform->DrainTasks(env->isolate());
more = uv_loop_alive(env->event_loop());
if (more && !env->is_stopping()) continue;
if (EmitProcessBeforeExit(env).IsNothing())
break;
// Emit `beforeExit` if the loop became alive either after emitting
// event, or after running some callbacks.
more = uv_loop_alive(env->event_loop());
} while (more == true && !env->is_stopping());

If I understand correctly, it should be rewritten to the following pseudocode:

      // while event loop has no work and background task is available to be executed,
      // execute a single background task.
      // Stop as soon as event loop gets something to do or we run out of background tasks
      while(true) {
        more = uv_loop_alive(env->event_loop()));
        if(more) break;
        didATask = platform->DrainSingleTask(env->isolate()); // DrainSingleTask is a new method to be implemented
        if(!didATask) break;
      }

      if (more && !env->is_stopping()) continue;

I'm still not sure if this will suffer from the issue I described here, where the event loop can be blocked by a single long task that's not important: #36616 (comment)

@gahaas
Copy link
Contributor

gahaas commented Jun 14, 2021

I don't think node blocking on a 5 second background task is an issue anymore. We had that in the past, but by now preempt background tasks regularly so that this cannot happen. Also, the important background tasks are spawned with higher priority, so they should typically get started before the unimportant ones.

@cspotcode
Copy link

Are there docs from V8 for the various work queues? I'm looking at https://v8.dev/docs, should I be looking elsewhere to learn more?

@gahaas
Copy link
Contributor

gahaas commented Jun 28, 2021

The best I can think of are the comments in v8-platform.h, which defines the API an embedder has to implement to provide a valid platform for V8.
You can also take a look at how the default platform is implemented in V8.

Did you try what I proposed above? Does it now work?

@cspotcode
Copy link

Coming back to this. I think some assumptions made in this thread may be incorrect.

BlockingDrain does not execute the tasks, rather it blocks the current thread indefinitely until there are no more tasks, waiting for other threads to execute them.

@gahaas
Copy link
Contributor

gahaas commented Jan 17, 2022

Indeed, my assumption was that BlockingDrain does execute tasks, and can be changed to execute just a single task. If BlockingDrain does not execute tasks, maybe it's implementation should then not wait until there are no more tasks, but just until Isolate::HasPendingBackgroundTasks() turns false or until a foreground task got posted.

An alternative would be to change BlockingDrain to execute a single task.

@cspotcode
Copy link

My current focus is figuring out how to wait for a foreground task to get posted. Does anyone know of any existing functionality for that?

My free time for this is limited, and so far node's extremely long build times have chewed through most of it. It's very difficult to justify the effort, which is I suspect why this bug remains unfixed a year later.

I also noticed that a workaround to this issue has stopped working in stable node releases:
You used to be able to process.exit() to eagerly end the process if you knew it would otherwise stay alive waiting for turbofan. That workaround works on node 14 but not on node 17.

@gahaas
Copy link
Contributor

gahaas commented Jan 17, 2022

Could you try if setting the V8 flag --wasm-dynamic-tiering fixes the problem for you? This is a new feature we are currently working on in V8 where we don't optimize wasm code so eagerly. This feature will be shipped soon, hopefully. Soon means in the next quarter. So if this feature fixes the problem, then maybe we could just wait.

The current implementation of the node platform is still wrong, in my opinion, but maybe it's not such a big issue with dynamic tiering.

@ekpyron
Copy link

ekpyron commented Jan 17, 2022

FYI, I can confirm that the process.exit() workaround stopped working for us (i.e. we still get delayed exit on node 17), but I can also confirm that --wasm-dynamic-tiering seems to solve this issue in our case.

@cspotcode
Copy link

Does V8 make any distinction between tasks that may create event loop work, and tasks that will not?

Looking at #15428

V8 platform tasks may schedule other tasks (both background and foreground), and may perform asynchronous operations like resolving Promises.

This is why node's SpinEventLoop implementation waits for all tasks to finish before concluding that the event loop has no more work:

if (env->is_stopping()) break;
uv_run(env->event_loop(), UV_RUN_DEFAULT);
if (env->is_stopping()) break;
platform->DrainTasks(isolate);
more = uv_loop_alive(env->event_loop());
if (more && !env->is_stopping()) continue;
if (EmitProcessBeforeExit(env).IsNothing())
break;

I believe this is the problem that needs to be solved: if tasks exist, but they will not schedule anything on the event loop, then node should proceed with calling beforeExit

@gahaas
Copy link
Contributor

gahaas commented Jan 17, 2022

If there are background tasks that may schedule foreground tasks, then Isolate::HasPendingBackgroundTasks() returns true. Otherwise Isolate::HasPendingBackgroundTasks() returns false and node should proceed with calling beforeExit.

@cspotcode
Copy link

I'm making progress.

I've tweaked NodePlatform::DrainTasks to use this loop, and now beforeExit and exit are calling immediately.

while(true) {
    while(per_isolate->FlushForegroundTasksInternal()) {}
    if(!per_isolate->HasPendingBackgroundTasks()) break;
    uv_sleep(10); // TODO replace with appropriate `Wait` for foreground task to be posted
}

However, the node process is still taking a while to exit because Isolate::Dispose() is taking a long time.

v8::Isolate* isolate_;

isolate_->Dispose();

My informal testing is loading @swc/wasm and synchronously invoking it 1000 times. Either @swc/wasm generates some resources or garbage that take a long time to cleanup, v8's WASM stuff generates resources that take a long time to dispose, or Isolate::Dispose() is still trying to flush all those background tasks. I'm not sure yet.

@cspotcode
Copy link

I've tracked the slowness down to OptimizingCompileDispatcher::Stop():

void OptimizingCompileDispatcher::Stop() {
HandleScope handle_scope(isolate_);
FlushQueues(BlockingBehavior::kBlock, false);
// At this point the optimizing compiler thread's event loop has stopped.
// There is no need for a mutex when reading input_queue_length_.
DCHECK_EQ(input_queue_length_, 0);
}

I'm going to wait for an expert to reply because I suspect they can offer guidance which will be far more productive than me spinning my wheels in the interim.

@gahaas
Copy link
Contributor

gahaas commented Jan 18, 2022

I wonder if the issue in the OptimizingCompileDispatcher would be worth a separate issue, maybe even on the V8 bug tracker. For the problem with WebAssembly compilation we have a solution now, don't we?

@cspotcode
Copy link

Attaching a large WASM file.
clang-11.wasm.zip

@mejedi how was this file created? I think I'll need to recreate it if we're going to write automated tests for this bugfix.

@cameel
Copy link

cameel commented Jan 18, 2022

In case @mejedi in not reachable, you could also try Solidity binaries which have the same problem, as mentioned above by @ekpyron.

You can build it by checking out https://github.com/ethereum/solidity/ and launching ./scripts/build_emscripten.sh, which will pull a docker image with all dependencies and compile it.

@cspotcode
Copy link

I wonder if the issue in the OptimizingCompileDispatcher would be worth a separate issue, maybe even on the V8 bug tracker. For the problem with WebAssembly compilation we have a solution now, don't we?

To be honest, I'm not really sure. I haven't had a chance to figure out what OptimizingCompileDispatcher is doing.

I've modified node's logic elsewhere so that it does not wait for turbofan tasks to finish. But is OptimizingCompileDispatcher waiting for them anyway? I'm not sure.

@cspotcode
Copy link

I've posted my work in progress here: cspotcode#1

@gahaas
Copy link
Contributor

gahaas commented Jan 19, 2022

The OptimizingCompileDispatcher manages the optimization of JavaScript code. I guess in your benchmark you are executing some JavaScript code often enough so that it gets hot, and V8 decides to optimize it. But then optimization is still happening when the benchmark wants to exit. The background work of the OptimizingCompileDispatcher would not set Isolate::HasPendingBackgroundTasks() to true, so the node platform would not have to wait for it.

As you also wrote above, it's not node.js that is waiting for the OptimizingCompileDispatcher, it is V8 itself. So if this is really something that needs to be fixed, it should be fixed in V8 and not in node.js. That's why I suggested to file a V8 bug.

@evanw
Copy link

evanw commented Dec 5, 2022

It looks like this may have actually been fixed? The first node release that doesn't have this problem is version 18.3.0:

Node version Time to run esbuild --version with WebAssembly in node
v14.21.1 3.27s
v16.18.1 2.51s
v18.0.0 1.89s
v18.2.0 1.90s
v18.3.0 0.32s ← The problem was fixed here
v18.5.0 0.31s
v18.12.1 0.31s

I didn't see any relevant changes in node itself for that release other than V8 version bumps. So I searched back in V8's history from version 10.2.154 (the version of V8 that node v18.3.0 uses) and found this commit that seems relevant: dynamic tiering for WebAssembly was enabled by default. I'm guessing that was what fixed it.

It's still not as fast as it could be (with the _exit(0) hack mentioned above esbuild --version takes 0.15s instead of 0.31s). But least node no longer takes multiple seconds to exit, which I'd consider good enough for me.

ajvpot referenced this issue in ajvpot/lockfileparsergo Dec 7, 2022
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [esbuild](https://togithub.com/evanw/esbuild) | [`^0.15.13` ->
`^0.16.0`](https://renovatebot.com/diffs/npm/esbuild/0.15.13/0.16.1) |
[![age](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/age-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/adoption-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/compatibility-slim/0.15.13)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/confidence-slim/0.15.13)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>evanw/esbuild</summary>

###
[`v0.16.1`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0161)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.0...v0.16.1)

This is a hotfix for the previous release.

- Re-allow importing JSON with the `copy` loader using an import
assertion

The previous release made it so when `assert { type: 'json' }` is
present on an import statement, esbuild validated that the `json` loader
was used. This is what an import assertion is supposed to do. However, I
forgot about the relatively new `copy` loader, which sort of behaves as
if the import path was marked as external (and thus not loaded at all)
except that the file is copied to the output directory and the import
path is rewritten to point to the copy. In this case whatever JavaScript
runtime ends up running the code is the one to evaluate the import
assertion. So esbuild should really allow this case as well. With this
release, esbuild now allows both the `json` and `copy` loaders when an
`assert { type: 'json' }` import assertion is present.

###
[`v0.16.0`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0160)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.18...v0.16.0)

**This release deliberately contains backwards-incompatible changes.**
To avoid automatically picking up releases like this, you should either
be pinning the exact version of `esbuild` in your `package.json` file
(recommended) or be using a version range syntax that only accepts patch
upgrades such as `~0.15.0`. See npm's documentation about
[semver](https://docs.npmjs.com/cli/v6/using-npm/semver/) for more
information.

-   Move all binary executable packages to the `@esbuild/` scope

Binary package executables for esbuild are published as individual
packages separate from the main `esbuild` package so you only have to
download the relevant one for the current platform when you install
esbuild. This release moves all of these packages under the `@esbuild/`
scope to avoid collisions with 3rd-party packages. It also changes them
to a consistent naming scheme that uses the `os` and `cpu` names from
node.

    The package name changes are as follows:

    -   `@esbuild/linux-loong64` => `@esbuild/linux-loong64` (no change)
    -   `esbuild-android-64` => `@esbuild/android-x64`
    -   `esbuild-android-arm64` => `@esbuild/android-arm64`
    -   `esbuild-darwin-64` => `@esbuild/darwin-x64`
    -   `esbuild-darwin-arm64` => `@esbuild/darwin-arm64`
    -   `esbuild-freebsd-64` => `@esbuild/freebsd-x64`
    -   `esbuild-freebsd-arm64` => `@esbuild/freebsd-arm64`
    -   `esbuild-linux-32` => `@esbuild/linux-ia32`
    -   `esbuild-linux-64` => `@esbuild/linux-x64`
    -   `esbuild-linux-arm` => `@esbuild/linux-arm`
    -   `esbuild-linux-arm64` => `@esbuild/linux-arm64`
    -   `esbuild-linux-mips64le` => `@esbuild/linux-mips64el`
    -   `esbuild-linux-ppc64le` => `@esbuild/linux-ppc64`
    -   `esbuild-linux-riscv64` => `@esbuild/linux-riscv64`
    -   `esbuild-linux-s390x` => `@esbuild/linux-s390x`
    -   `esbuild-netbsd-64` => `@esbuild/netbsd-x64`
    -   `esbuild-openbsd-64` => `@esbuild/openbsd-x64`
    -   `esbuild-sunos-64` => `@esbuild/sunos-x64`
    -   `esbuild-wasm` => `esbuild-wasm` (no change)
    -   `esbuild-windows-32` => `@esbuild/win32-ia32`
    -   `esbuild-windows-64` => `@esbuild/win32-x64`
    -   `esbuild-windows-arm64` => `@esbuild/win32-arm64`
    -   `esbuild` => `esbuild` (no change)

Normal usage of the `esbuild` and `esbuild-wasm` packages should not be
affected. These name changes should only affect tools that hard-coded
the individual binary executable package names into custom esbuild
downloader scripts.

This change was not made with performance in mind. But as a bonus,
installing esbuild with npm may potentially happen faster now. This is
because npm's package installation protocol is inefficient: it always
downloads metadata for all past versions of each package even when it
only needs metadata about a single version. This makes npm package
downloads O(n) in the number of published versions, which penalizes
packages like esbuild that are updated regularly. Since most of
esbuild's package names have now changed, npm will now need to download
much less data when installing esbuild (8.72mb of package manifests
before this change → 0.06mb of package manifests after this change).
However, this is only a temporary improvement. Installing esbuild will
gradually get slower again as further versions of esbuild are published.

-   Publish a shell script that downloads esbuild directly

In addition to all of the existing ways to install esbuild, you can now
also download esbuild directly like this:

    ```sh
    curl -fsSL https://esbuild.github.io/dl/latest | sh
    ```

This runs a small shell script that downloads the latest `esbuild`
binary executable to the current directory. This can be convenient on
systems that don't have `npm` installed or when you just want to get a
copy of esbuild quickly without any extra steps. If you want a specific
version of esbuild (starting with this version onward), you can provide
that version in the URL instead of `latest`:

    ```sh
    curl -fsSL https://esbuild.github.io/dl/v0.16.0 | sh
    ```

Note that the download script needs to be able to access
registry.npmjs.org to be able to complete the download. This download
script doesn't yet support all of the platforms that esbuild supports
because I lack the necessary testing environments. If the download
script doesn't work for you because you're on an unsupported platform,
please file an issue on the esbuild repo so we can add support for it.

-   Fix some parameter names for the Go API

This release changes some parameter names for the Go API to be
consistent with the JavaScript and CLI APIs:

    -   `OutExtensions` => `OutExtension`
    -   `JSXMode` => `JSX`

-   Add additional validation of API parameters

The JavaScript API now does some additional validation of API parameters
to catch incorrect uses of esbuild's API. The biggest impact of this is
likely that esbuild now strictly only accepts strings with the `define`
parameter. This would already have been a type error with esbuild's
TypeScript type definitions, but it was previously not enforced for
people using esbuild's API JavaScript without TypeScript.

The `define` parameter appears at first glance to take a JSON object if
you aren't paying close attention, but this actually isn't true. Values
for `define` are instead strings of JavaScript code. This means you have
to use `define: { foo: '"bar"' }` to replace `foo` with the string
`"bar"`. Using `define: { foo: 'bar' }` actually replaces `foo` with the
identifier `bar`. Previously esbuild allowed you to pass `define: { foo:
false }` and `false` was automatically converted into a string, which
made it more confusing to understand what `define` actually represents.
Starting with this release, passing non-string values such as with
`define: { foo: false }` will no longer be allowed. You will now have to
write `define: { foo: 'false' }` instead.

- Generate shorter data URLs if possible
([#&#8203;1843](https://togithub.com/evanw/esbuild/issues/1843))

Loading a file with esbuild's `dataurl` loader generates a JavaScript
module with a [data
URL](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URLs)
for that file in a string as a single default export. Previously the
data URLs generated by esbuild all used [base64
encoding](https://en.wikipedia.org/wiki/Base64). However, this is
unnecessarily long for most textual data (e.g. SVG images). So with this
release, esbuild's `dataurl` loader will now use percent encoding
instead of base64 encoding if the result will be shorter. This can
result in ~25% smaller data URLs for large SVGs. If you want the old
behavior, you can use the `base64` loader instead and then construct the
data URL yourself.

- Avoid marking entry points as external
([#&#8203;2382](https://togithub.com/evanw/esbuild/issues/2382))

Previously you couldn't specify `--external:*` to mark all import paths
as external because that also ended up making the entry point itself
external, which caused the build to fail. With this release, esbuild's
`external` API parameter no longer applies to entry points so using
`--external:*` is now possible.

One additional consequence of this change is that the `kind` parameter
is now required when calling the `resolve()` function in esbuild's
plugin API. Previously the `kind` parameter defaulted to `entry-point`,
but that no longer interacts with `external` so it didn't seem wise for
this to continue to be the default. You now have to specify `kind` so
that the path resolution mode is explicit.

- Disallow non-`default` imports when `assert { type: 'json' }` is
present

There is now standard behavior for importing a JSON file into an ES
module using an `import` statement. However, it requires you to place
the `assert { type: 'json' }` import assertion after the import path.
This import assertion tells the JavaScript runtime to throw an error if
the import does not end up resolving to a JSON file. On the web, the
type of a file is determined by the `Content-Type` HTTP header instead
of by the file extension. The import assertion prevents security
problems on the web where a `.json` file may actually resolve to a
JavaScript file containing malicious code, which is likely not expected
for an import that is supposed to only contain pure side-effect free
data.

By default, esbuild uses the file extension to determine the type of a
file, so this import assertion is unnecessary with esbuild. However,
esbuild's JSON import feature has a non-standard extension that allows
you to import top-level properties of the JSON object as named imports.
For example, esbuild lets you do this:

    ```js
    import { version } from './package.json'
    ```

This is useful for tree-shaking when bundling because it means esbuild
will only include the the `version` field of `package.json` in your
bundle. This is non-standard behavior though and doesn't match the
behavior of what happens when you import JSON in a real JavaScript
runtime (after adding `assert { type: 'json' }`). In a real JavaScript
runtime the only thing you can import is the `default` import. So with
this release, esbuild will now prevent you from importing non-`default`
import names if `assert { type: 'json' }` is present. This ensures that
code containing `assert { type: 'json' }` isn't relying on non-standard
behavior that won't work everywhere. So the following code is now an
error with esbuild when bundling:

    ```js
    import { version } from './package.json' assert { type: 'json' }
    ```

In addition, adding `assert { type: 'json' }` to an import statement now
means esbuild will generate an error if the loader for the file is
anything other than `json`, which is required by the import assertion
specification.

- Provide a way to disable automatic escaping of `</script>`
([#&#8203;2649](https://togithub.com/evanw/esbuild/issues/2649))

If you inject esbuild's output into a script tag in an HTML file, code
containing the literal characters `</script>` will cause the tag to be
ended early which will break the code:

    ```html
    <script>
      console.log("</script>");
    </script>
    ```

To avoid this, esbuild automatically escapes these strings in generated
JavaScript files (e.g. `"</script>"` becomes `"<\/script>"` instead).
This also applies to `</style>` in generated CSS files. Previously this
always happened and there wasn't a way to turn this off.

With this release, esbuild will now only do this if the `platform`
setting is set to `browser` (the default value). Setting `platform` to
`node` or `neutral` will disable this behavior. This behavior can also
now be disabled with `--supported:inline-script=false` (for JS) and
`--supported:inline-style=false` (for CSS).

- Throw an early error if decoded UTF-8 text isn't a `Uint8Array`
([#&#8203;2532](https://togithub.com/evanw/esbuild/issues/2532))

If you run esbuild's JavaScript API in a broken JavaScript environment
where `new TextEncoder().encode("") instanceof Uint8Array` is false,
then esbuild's API will fail with a confusing serialization error
message that makes it seem like esbuild has a bug even though the real
problem is that the JavaScript environment itself is broken. This can
happen when using the test framework called [Jest](https://jestjs.io/).
With this release, esbuild's API will now throw earlier when it detects
that the environment is unable to encode UTF-8 text correctly with an
error message that makes it more clear that this is not a problem with
esbuild.

-   Change the default "legal comment" behavior

The legal comments feature automatically gathers comments containing
`@license` or `@preserve` and puts the comments somewhere (either in the
generated code or in a separate file). People sometimes want this to
happen so that the their dependencies' software licenses are retained in
the generated output code. By default esbuild puts these comments at the
end of the file when bundling. However, people sometimes find this
confusing because these comments can be very generic and may not mention
which library they come from. So with this release, esbuild will now
discard legal comments by default. You now have to opt-in to preserving
them if you want this behavior.

- Enable the `module` condition by default
([#&#8203;2417](https://togithub.com/evanw/esbuild/issues/2417))

Package authors want to be able to use the new
[`exports`](https://nodejs.org/api/packages.html#conditional-exports)
field in `package.json` to provide tree-shakable ESM code for ESM-aware
bundlers while simultaneously providing fallback CommonJS code for other
cases.

Node's proposed way to do this involves using the `import` and `require`
export conditions so that you get the ESM code if you use an import
statement and the CommonJS code if you use a require call. However, this
has a major drawback: if some code in the bundle uses an import
statement and other code in the bundle uses a require call, then you'll
get two copies of the same package in the bundle. This is known as the
[dual package
hazard](https://nodejs.org/api/packages.html#dual-package-hazard) and
can lead to bloated bundles or even worse to subtle logic bugs.

Webpack supports an alternate solution: an export condition called
`module` that takes effect regardless of whether the package was
imported using an import statement or a require call. This works because
bundlers such as Webpack support importing a ESM using a require call
(something node doesn't support). You could already do this with esbuild
using `--conditions=module` but you previously had to explicitly enable
this. Package authors are concerned that esbuild users won't know to do
this and will get suboptimal output with their package, so they have
requested for esbuild to do this automatically.

So with this release, esbuild will now automatically add the `module`
condition when there aren't any custom `conditions` already configured.
You can disable this with `--conditions=` or `conditions: []` (i.e.
explicitly clearing all custom conditions).

-   Rename the `master` branch to `main`

The primary branch for this repository was previously called `master`
but is now called `main`. This change mirrors a similar change in many
other projects.

- Remove esbuild's `_exit(0)` hack for WebAssembly
([#&#8203;714](https://togithub.com/evanw/esbuild/issues/714))

Node had an unfortunate bug where the node process is unnecessarily kept
open while a WebAssembly module is being optimized:
[https://github.com/nodejs/node/issues/36616](https://togithub.com/nodejs/node/issues/36616).
This means cases where running `esbuild` should take a few milliseconds
can end up taking many seconds instead.

The workaround was to force node to exit by ending the process early.
This was done by esbuild in one of two ways depending on the exit code.
For non-zero exit codes (i.e. when there is a build error), the
`esbuild` command could just call `process.kill(process.pid)` to avoid
the hang. But for zero exit codes, esbuild had to load a N-API native
node extension that calls the operating system's `exit(0)` function.

However, this problem has essentially been fixed in node starting with
version 18.3.0. So I have removed this hack from esbuild. If you are
using an earlier version of node with `esbuild-wasm` and you don't want
the `esbuild` command to hang for a while when exiting, you can upgrade
to node 18.3.0 or higher to remove the hang.

The fix came from a V8 upgrade: [this
commit](https://togithub.com/v8/v8/commit/bfe12807c14c91714c7db1485e6b265439375e16)
enabled [dynamic tiering for
WebAssembly](https://v8.dev/blog/wasm-dynamic-tiering) by default for
all projects that use V8's WebAssembly implementation. Previously all
functions in the WebAssembly module were optimized in a single batch job
but with dynamic tiering, V8 now optimizes individual WebAssembly
functions as needed. This avoids unnecessary WebAssembly compilation
which allows node to exit on time.

###
[`v0.15.18`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;01518)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.17...v0.15.18)

-   Performance improvements for both JS and CSS

This release brings noticeable performance improvements for JS parsing
and for CSS parsing and printing. Here's an example benchmark for using
esbuild to pretty-print a single large minified CSS file and JS file:

    | Test case      | Previous release | This release       |
    |----------------|------------------|--------------------|
    | 4.8mb CSS file | 19ms             | 11ms (1.7x faster) |
    | 5.8mb JS file  | 36ms             | 32ms (1.1x faster) |

    The performance improvements were very straightforward:

- Identifiers were being scanned using a generic character advancement
function instead of using custom inline code. Advancing past each
character involved UTF-8 decoding as well as updating multiple member
variables. This was sped up using loop that skips UTF-8 decoding
entirely and that only updates member variables once at the end. This is
faster because identifiers are plain ASCII in the vast majority of
cases, so Unicode decoding is almost always unnecessary.

- CSS identifiers and CSS strings were still being printed one character
at a time. Apparently I forgot to move this part of esbuild's CSS
infrastructure beyond the proof-of-concept stage. These were both very
obvious in the profiler, so I think maybe I have just never profiled
esbuild's CSS printing before?

- There was unnecessary work being done that was related to source maps
when source map output was disabled. I likely haven't observed this
before because esbuild's benchmarks always have source maps enabled.
This work is now disabled when it's not going to be used.

I definitely should have caught these performance issues earlier. Better
late than never I suppose.

###
[`v0.15.17`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;01517)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.16...v0.15.17)

- Search for missing source map code on the file system
([#&#8203;2711](https://togithub.com/evanw/esbuild/issues/2711))

[Source maps](https://sourcemaps.info/spec.html) are JSON files that map
from compiled code back to the original code. They provide the original
source code using two arrays: `sources` (required) and `sourcesContent`
(optional). When bundling is enabled, esbuild is able to bundle code
with source maps that was compiled by other tools (e.g. with Webpack)
and emit source maps that map all the way back to the original code
(e.g. before Webpack compiled it).

Previously if the input source maps omitted the optional
`sourcesContent` array, esbuild would use `null` for the source content
in the source map that it generates (since the source content isn't
available). However, sometimes the original source code is actually
still present on the file system. With this release, esbuild will now
try to find the original source code using the path in the `sources`
array and will use that instead of `null` if it was found.

- Fix parsing bug with TypeScript `infer` and `extends`
([#&#8203;2712](https://togithub.com/evanw/esbuild/issues/2712))

This release fixes a bug where esbuild incorrectly failed to parse valid
TypeScript code that nests `extends` inside `infer` inside `extends`,
such as in the example below:

    ```ts
    type A<T> = {};
    type B = {} extends infer T extends {} ? A<T> : never;
    ```

    TypeScript code that does this should now be parsed correctly.

- Use `WebAssembly.instantiateStreaming` if available
([#&#8203;1036](https://togithub.com/evanw/esbuild/pull/1036),
[#&#8203;1900](https://togithub.com/evanw/esbuild/pull/1900))

Currently the WebAssembly version of esbuild uses `fetch` to download
`esbuild.wasm` and then `WebAssembly.instantiate` to compile it. There
is a newer API called `WebAssembly.instantiateStreaming` that both
downloads and compiles at the same time, which can be a performance
improvement if both downloading and compiling are slow. With this
release, esbuild now attempts to use `WebAssembly.instantiateStreaming`
and falls back to the original approach if that fails.

The implementation for this builds on a PR by
[@&#8203;lbwa](https://togithub.com/lbwa).

- Preserve Webpack comments inside constructor calls
([#&#8203;2439](https://togithub.com/evanw/esbuild/issues/2439))

This improves the use of esbuild as a faster TypeScript-to-JavaScript
frontend for Webpack, which has special [magic
comments](https://webpack.js.org/api/module-methods/#magic-comments)
inside `new Worker()` expressions that affect Webpack's behavior.

###
[`v0.15.16`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;01516)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.15...v0.15.16)

- Add a package alias feature
([#&#8203;2191](https://togithub.com/evanw/esbuild/issues/2191))

With this release, you can now easily substitute one package for another
at build time with the new `alias` feature. For example,
`--alias:oldpkg=newpkg` replaces all imports of `oldpkg` with `newpkg`.
One use case for this is easily replacing a node-only package with a
browser-friendly package in 3rd-party code that you don't control. These
new substitutions happen first before all of esbuild's existing path
resolution logic.

Note that when an import path is substituted using an alias, the
resulting import path is resolved in the working directory instead of in
the directory containing the source file with the import path. If
needed, the working directory can be set with the `cd` command when
using the CLI or with the `absWorkingDir` setting when using the JS or
Go APIs.

- Fix crash when pretty-printing minified JSX with object spread of
object literal with computed property
([#&#8203;2697](https://togithub.com/evanw/esbuild/issues/2697))

JSX elements are translated to JavaScript function calls and JSX element
attributes are translated to properties on a JavaScript object literal.
These properties are always either strings (e.g. in `<x y />`, `y` is a
string) or an object spread (e.g. in `<x {...y} />`, `y` is an object
spread) because JSX doesn't provide syntax for directly passing a
computed property as a JSX attribute. However, esbuild's minifier has a
rule that tries to inline object spread with an inline object literal in
JavaScript. For example, `x = { ...{ y } }` is minified to `x={y}` when
minification is enabled. This means that there is a way to generate a
non-string non-spread JSX attribute in esbuild's internal
representation. One example is with `<x {...{ [y]: z }} />`. When
minification is enabled, esbuild's internal representation of this is
something like `<x [y]={z} />` due to object spread inlining, which is
not valid JSX syntax. If this internal representation is then
pretty-printed as JSX using `--minify --jsx=preserve`, esbuild
previously crashed when trying to print this invalid syntax. With this
release, esbuild will now print `<x {...{[y]:z}}/>` in this scenario
instead of crashing.

###
[`v0.15.15`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;01515)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.14...v0.15.15)

- Remove duplicate CSS rules across files
([#&#8203;2688](https://togithub.com/evanw/esbuild/issues/2688))

When two or more CSS rules are exactly the same (even if they are not
adjacent), all but the last one can safely be removed:

    ```css
    /* Before */
    a { color: red; }
    span { font-weight: bold; }
    a { color: red; }

    /* After */
    span { font-weight: bold; }
    a { color: red; }
    ```

Previously esbuild only did this transformation within a single source
file. But with this release, esbuild will now do this transformation
across source files, which may lead to smaller CSS output if the same
rules are repeated across multiple CSS source files in the same bundle.
This transformation is only enabled when minifying (specifically when
syntax minification is enabled).

- Add `deno` as a valid value for `target`
([#&#8203;2686](https://togithub.com/evanw/esbuild/issues/2686))

The `target` setting in esbuild allows you to enable or disable
JavaScript syntax features for a given version of a set of target
JavaScript VMs. Previously [Deno](https://deno.land/) was not one of the
JavaScript VMs that esbuild supported with `target`, but it will now be
supported starting from this release. For example, versions of Deno
older than v1.2 don't support the new `||=` operator, so adding e.g.
`--target=deno1.0` to esbuild now lets you tell esbuild to transpile
`||=` to older JavaScript.

- Fix the `esbuild-wasm` package in Node v19
([#&#8203;2683](https://togithub.com/evanw/esbuild/issues/2683))

A recent change to Node v19 added a non-writable `crypto` property to
the global object:
[https://github.com/nodejs/node/pull/44897](https://togithub.com/nodejs/node/pull/44897).
This conflicts with Go's WebAssembly shim code, which overwrites the
global `crypto` property. As a result, all Go-based WebAssembly code
that uses the built-in shim (including esbuild) is now broken on Node
v19. This release of esbuild fixes the issue by reconfiguring the global
`crypto` property to be writable before invoking Go's WebAssembly shim
code.

- Fix CSS dimension printing exponent confusion edge case
([#&#8203;2677](https://togithub.com/evanw/esbuild/issues/2677))

In CSS, a dimension token has a numeric "value" part and an identifier
"unit" part. For example, the dimension token `32px` has a value of `32`
and a unit of `px`. The unit can be any valid CSS identifier. The value
can be any number in floating-point format including an optional
exponent (e.g. `-3.14e-0` has an exponent of `e-0`). The full details of
this syntax are here: https://www.w3.org/TR/css-syntax-3/.

To maintain the integrity of the dimension token through the printing
process, esbuild must handle the edge case where the unit looks like an
exponent. One such case is the dimension `1e\32` which has the value `1`
and the unit `e2`. It would be bad if this dimension token was printed
such that a CSS parser would parse it as a number token with the value
`1e2` instead of a dimension token. The way esbuild currently does this
is to escape the leading `e` in the dimension unit, so esbuild would
parse `1e\32` but print `1\65 2` (both `1e\32` and `1\65 2` represent a
dimension token with a value of `1` and a unit of `e2`).

However, there is an even narrower edge case regarding this edge case.
If the value part of the dimension token itself has an `e`, then it's
not necessary to escape the `e` in the dimension unit because a CSS
parser won't confuse the unit with the exponent even though it looks
like one (since a number can only have at most one exponent). This came
up because the grammar for the CSS `unicode-range` property uses a hack
that lets you specify a hexadecimal range without quotes even though CSS
has no token for a hexadecimal range. The hack is to allow the
hexadecimal range to be parsed as a dimension token and optionally also
a number token. Here is the grammar for `unicode-range`:

        unicode-range =
          <urange>#

        <urange> =
          u '+' <ident-token> '?'*            |
          u <dimension-token> '?'*            |
          u <number-token> '?'*               |
          u <number-token> <dimension-token>  |
          u <number-token> <number-token>     |
          u '+' '?'+

and here is an example `unicode-range` declaration that was problematic
for esbuild:

    ```css
    @&#8203;font-face {
      unicode-range: U+0e2e-0e2f;
    }
    ```

This is parsed as a dimension with a value of `+0e2` and a unit of
`e-0e2f`. This was problematic for esbuild because the unit starts with
`e-0` which could be confused with an exponent when appended after a
number, so esbuild was escaping the `e` character in the unit. However,
this escaping is unnecessary because in this case the dimension value
already has an exponent in it. With this release, esbuild will no longer
unnecessarily escape the `e` in the dimension unit in these cases, which
should fix the printing of `unicode-range` declarations.

An aside: You may be wondering why esbuild is trying to escape the `e`
at all and why it doesn't just pass through the original source code
unmodified. The reason why esbuild does this is that, for robustness,
esbuild's AST generally tries to omit semantically-unrelated information
and esbuild's code printers always try to preserve the semantics of the
underlying AST. That way the rest of esbuild's internals can just deal
with semantics instead of presentation. They don't have to think about
how the AST will be printed when changing the AST. This is the same
reason that esbuild's JavaScript AST doesn't have a "parentheses" node
(e.g. `a * (b + c)` is represented by the AST `multiply(a, add(b, c))`
instead of `multiply(a, parentheses(add(b, c)))`). Instead, the printer
automatically inserts parentheses as necessary to maintain the semantics
of the AST, which means all of the optimizations that run over the AST
don't have to worry about keeping the parentheses up to date. Similarly,
the CSS AST for the dimension token stores the actual unit and the
printer makes sure the unit is properly escaped depending on what value
it's placed after. All of the other code operating on CSS ASTs doesn't
have to worry about parsing escapes to compare units or about keeping
escapes up to date when the AST is modified. Hopefully that makes sense.

- Attempt to avoid creating the `node_modules/.cache` directory for
people that use Yarn 2+ in Plug'n'Play mode
([#&#8203;2685](https://togithub.com/evanw/esbuild/issues/2685))

When Yarn's PnP mode is enabled, packages installed by Yarn may or may
not be put inside `.zip` files. The specific heuristics for when this
happens change over time in between Yarn versions. This is problematic
for esbuild because esbuild's JavaScript package needs to execute a
binary file inside the package. Yarn makes extensive modifications to
Node's file system APIs at run time to pretend that `.zip` files are
normal directories and to make it hard to tell whether a file is real or
not (since in theory it doesn't matter). But they haven't modified
Node's `child_process.execFileSync` API so attempting to execute a file
inside a zip file fails. To get around this, esbuild previously used
Node's file system APIs to copy the binary executable to another
location before invoking `execFileSync`. Under the hood this caused Yarn
to extract the file from the zip file into a real file that can then be
run.

However, esbuild copied its executable into
`node_modules/.cache/esbuild`. This is the [official recommendation from
the Yarn
team](https://yarnpkg.com/advanced/rulebook/#packages-should-never-write-inside-their-own-folder-outside-of-postinstall)
for where packages are supposed to put these types of files when Yarn
PnP is being used. However, users of Yarn PnP with esbuild find this
really annoying because they don't like looking at the `node_modules`
directory. With this release, esbuild now sets `"preferUnplugged": true`
in its `package.json` files, which tells newer versions of Yarn to not
put esbuild's packages in a zip file. There may exist older versions of
Yarn that don't support `preferUnplugged`. In that case esbuild should
still copy the executable to a cache directory, so it should still run
(hopefully, since I haven't tested this myself). Note that esbuild
setting `"preferUnplugged": true` may have the side effect of esbuild
taking up more space on the file system in the event that multiple
platforms are installed simultaneously, or that you're using an older
version of Yarn that always installs packages for all platforms. In that
case you may want to update to a newer version of Yarn since Yarn has
recently changed to only install packages for the current platform.

###
[`v0.15.14`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;01514)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.13...v0.15.14)

- Fix parsing of TypeScript `infer` inside a conditional `extends`
([#&#8203;2675](https://togithub.com/evanw/esbuild/issues/2675))

Unlike JavaScript, parsing TypeScript sometimes requires backtracking.
The `infer A` type operator can take an optional constraint of the form
`infer A extends B`. However, this syntax conflicts with the similar
conditional type operator `A extends B ? C : D` in cases where the
syntax is combined, such as `infer A extends B ? C : D`. This is
supposed to be parsed as `(infer A) extends B ? C : D`. Previously
esbuild incorrectly parsed this as `(infer A extends B) ? C : D`
instead, which is a parse error since the `?:` conditional operator
requires the `extends` keyword as part of the conditional type.
TypeScript disambiguates by speculatively parsing the `extends` after
the `infer`, but backtracking if a `?` token is encountered afterward.
With this release, esbuild should now do the same thing, so esbuild
should now correctly parse these types. Here's a real-world example of
such a type:

    ```ts
type Normalized<T> = T extends Array<infer A extends object ? infer A :
never>
      ? Dictionary<Normalized<A>>
      : {
[P in keyof T]: T[P] extends Array<infer A extends object ? infer A :
never>
            ? Dictionary<Normalized<A>>
            : Normalized<T[P]>
        }
    ```

- Avoid unnecessary watch mode rebuilds when debug logging is enabled
([#&#8203;2661](https://togithub.com/evanw/esbuild/issues/2661))

When debug-level logs are enabled (such as with `--log-level=debug`),
esbuild's path resolution subsystem generates debug log messages that
say something like "Read 20 entries for directory /home/user" to help
you debug what esbuild's path resolution is doing. This caused esbuild's
watch mode subsystem to add a dependency on the full list of entries in
that directory since if that changes, the generated log message would
also have to be updated. However, meant that on systems where a parent
directory undergoes constant directory entry churn, esbuild's watch mode
would continue to rebuild if `--log-level=debug` was passed.

With this release, these debug log messages are now generated by
"peeking" at the file system state while bypassing esbuild's watch mode
dependency tracking. So now watch mode doesn't consider the count of
directory entries in these debug log messages to be a part of the build
that needs to be kept up to date when the file system state changes.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/ajvpot/lockfileparsergo).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC40OS4wIiwidXBkYXRlZEluVmVyIjoiMzQuNDkuMCJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Alex Vanderpot <[email protected]>
ajvpot referenced this issue in ajvpot/lockfileparsergo Dec 7, 2022
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [esbuild](https://togithub.com/evanw/esbuild) | [`^0.15.13` ->
`^0.16.0`](https://renovatebot.com/diffs/npm/esbuild/0.15.13/0.16.1) |
[![age](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/age-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/adoption-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/compatibility-slim/0.15.13)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/confidence-slim/0.15.13)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>evanw/esbuild</summary>

###
[`v0.16.1`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0161)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.0...v0.16.1)

This is a hotfix for the previous release.

- Re-allow importing JSON with the `copy` loader using an import
assertion

The previous release made it so when `assert { type: 'json' }` is
present on an import statement, esbuild validated that the `json` loader
was used. This is what an import assertion is supposed to do. However, I
forgot about the relatively new `copy` loader, which sort of behaves as
if the import path was marked as external (and thus not loaded at all)
except that the file is copied to the output directory and the import
path is rewritten to point to the copy. In this case whatever JavaScript
runtime ends up running the code is the one to evaluate the import
assertion. So esbuild should really allow this case as well. With this
release, esbuild now allows both the `json` and `copy` loaders when an
`assert { type: 'json' }` import assertion is present.

###
[`v0.16.0`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0160)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.18...v0.16.0)

**This release deliberately contains backwards-incompatible changes.**
To avoid automatically picking up releases like this, you should either
be pinning the exact version of `esbuild` in your `package.json` file
(recommended) or be using a version range syntax that only accepts patch
upgrades such as `~0.15.0`. See npm's documentation about
[semver](https://docs.npmjs.com/cli/v6/using-npm/semver/) for more
information.

-   Move all binary executable packages to the `@esbuild/` scope

Binary package executables for esbuild are published as individual
packages separate from the main `esbuild` package so you only have to
download the relevant one for the current platform when you install
esbuild. This release moves all of these packages under the `@esbuild/`
scope to avoid collisions with 3rd-party packages. It also changes them
to a consistent naming scheme that uses the `os` and `cpu` names from
node.

    The package name changes are as follows:

    -   `@esbuild/linux-loong64` => `@esbuild/linux-loong64` (no change)
    -   `esbuild-android-64` => `@esbuild/android-x64`
    -   `esbuild-android-arm64` => `@esbuild/android-arm64`
    -   `esbuild-darwin-64` => `@esbuild/darwin-x64`
    -   `esbuild-darwin-arm64` => `@esbuild/darwin-arm64`
    -   `esbuild-freebsd-64` => `@esbuild/freebsd-x64`
    -   `esbuild-freebsd-arm64` => `@esbuild/freebsd-arm64`
    -   `esbuild-linux-32` => `@esbuild/linux-ia32`
    -   `esbuild-linux-64` => `@esbuild/linux-x64`
    -   `esbuild-linux-arm` => `@esbuild/linux-arm`
    -   `esbuild-linux-arm64` => `@esbuild/linux-arm64`
    -   `esbuild-linux-mips64le` => `@esbuild/linux-mips64el`
    -   `esbuild-linux-ppc64le` => `@esbuild/linux-ppc64`
    -   `esbuild-linux-riscv64` => `@esbuild/linux-riscv64`
    -   `esbuild-linux-s390x` => `@esbuild/linux-s390x`
    -   `esbuild-netbsd-64` => `@esbuild/netbsd-x64`
    -   `esbuild-openbsd-64` => `@esbuild/openbsd-x64`
    -   `esbuild-sunos-64` => `@esbuild/sunos-x64`
    -   `esbuild-wasm` => `esbuild-wasm` (no change)
    -   `esbuild-windows-32` => `@esbuild/win32-ia32`
    -   `esbuild-windows-64` => `@esbuild/win32-x64`
    -   `esbuild-windows-arm64` => `@esbuild/win32-arm64`
    -   `esbuild` => `esbuild` (no change)

Normal usage of the `esbuild` and `esbuild-wasm` packages should not be
affected. These name changes should only affect tools that hard-coded
the individual binary executable package names into custom esbuild
downloader scripts.

This change was not made with performance in mind. But as a bonus,
installing esbuild with npm may potentially happen faster now. This is
because npm's package installation protocol is inefficient: it always
downloads metadata for all past versions of each package even when it
only needs metadata about a single version. This makes npm package
downloads O(n) in the number of published versions, which penalizes
packages like esbuild that are updated regularly. Since most of
esbuild's package names have now changed, npm will now need to download
much less data when installing esbuild (8.72mb of package manifests
before this change → 0.06mb of package manifests after this change).
However, this is only a temporary improvement. Installing esbuild will
gradually get slower again as further versions of esbuild are published.

-   Publish a shell script that downloads esbuild directly

In addition to all of the existing ways to install esbuild, you can now
also download esbuild directly like this:

    ```sh
    curl -fsSL https://esbuild.github.io/dl/latest | sh
    ```

This runs a small shell script that downloads the latest `esbuild`
binary executable to the current directory. This can be convenient on
systems that don't have `npm` installed or when you just want to get a
copy of esbuild quickly without any extra steps. If you want a specific
version of esbuild (starting with this version onward), you can provide
that version in the URL instead of `latest`:

    ```sh
    curl -fsSL https://esbuild.github.io/dl/v0.16.0 | sh
    ```

Note that the download script needs to be able to access
registry.npmjs.org to be able to complete the download. This download
script doesn't yet support all of the platforms that esbuild supports
because I lack the necessary testing environments. If the download
script doesn't work for you because you're on an unsupported platform,
please file an issue on the esbuild repo so we can add support for it.

-   Fix some parameter names for the Go API

This release changes some parameter names for the Go API to be
consistent with the JavaScript and CLI APIs:

    -   `OutExtensions` => `OutExtension`
    -   `JSXMode` => `JSX`

-   Add additional validation of API parameters

The JavaScript API now does some additional validation of API parameters
to catch incorrect uses of esbuild's API. The biggest impact of this is
likely that esbuild now strictly only accepts strings with the `define`
parameter. This would already have been a type error with esbuild's
TypeScript type definitions, but it was previously not enforced for
people using esbuild's API JavaScript without TypeScript.

The `define` parameter appears at first glance to take a JSON object if
you aren't paying close attention, but this actually isn't true. Values
for `define` are instead strings of JavaScript code. This means you have
to use `define: { foo: '"bar"' }` to replace `foo` with the string
`"bar"`. Using `define: { foo: 'bar' }` actually replaces `foo` with the
identifier `bar`. Previously esbuild allowed you to pass `define: { foo:
false }` and `false` was automatically converted into a string, which
made it more confusing to understand what `define` actually represents.
Starting with this release, passing non-string values such as with
`define: { foo: false }` will no longer be allowed. You will now have to
write `define: { foo: 'false' }` instead.

- Generate shorter data URLs if possible
([#&#8203;1843](https://togithub.com/evanw/esbuild/issues/1843))

Loading a file with esbuild's `dataurl` loader generates a JavaScript
module with a [data
URL](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URLs)
for that file in a string as a single default export. Previously the
data URLs generated by esbuild all used [base64
encoding](https://en.wikipedia.org/wiki/Base64). However, this is
unnecessarily long for most textual data (e.g. SVG images). So with this
release, esbuild's `dataurl` loader will now use percent encoding
instead of base64 encoding if the result will be shorter. This can
result in ~25% smaller data URLs for large SVGs. If you want the old
behavior, you can use the `base64` loader instead and then construct the
data URL yourself.

- Avoid marking entry points as external
([#&#8203;2382](https://togithub.com/evanw/esbuild/issues/2382))

Previously you couldn't specify `--external:*` to mark all import paths
as external because that also ended up making the entry point itself
external, which caused the build to fail. With this release, esbuild's
`external` API parameter no longer applies to entry points so using
`--external:*` is now possible.

One additional consequence of this change is that the `kind` parameter
is now required when calling the `resolve()` function in esbuild's
plugin API. Previously the `kind` parameter defaulted to `entry-point`,
but that no longer interacts with `external` so it didn't seem wise for
this to continue to be the default. You now have to specify `kind` so
that the path resolution mode is explicit.

- Disallow non-`default` imports when `assert { type: 'json' }` is
present

There is now standard behavior for importing a JSON file into an ES
module using an `import` statement. However, it requires you to place
the `assert { type: 'json' }` import assertion after the import path.
This import assertion tells the JavaScript runtime to throw an error if
the import does not end up resolving to a JSON file. On the web, the
type of a file is determined by the `Content-Type` HTTP header instead
of by the file extension. The import assertion prevents security
problems on the web where a `.json` file may actually resolve to a
JavaScript file containing malicious code, which is likely not expected
for an import that is supposed to only contain pure side-effect free
data.

By default, esbuild uses the file extension to determine the type of a
file, so this import assertion is unnecessary with esbuild. However,
esbuild's JSON import feature has a non-standard extension that allows
you to import top-level properties of the JSON object as named imports.
For example, esbuild lets you do this:

    ```js
    import { version } from './package.json'
    ```

This is useful for tree-shaking when bundling because it means esbuild
will only include the the `version` field of `package.json` in your
bundle. This is non-standard behavior though and doesn't match the
behavior of what happens when you import JSON in a real JavaScript
runtime (after adding `assert { type: 'json' }`). In a real JavaScript
runtime the only thing you can import is the `default` import. So with
this release, esbuild will now prevent you from importing non-`default`
import names if `assert { type: 'json' }` is present. This ensures that
code containing `assert { type: 'json' }` isn't relying on non-standard
behavior that won't work everywhere. So the following code is now an
error with esbuild when bundling:

    ```js
    import { version } from './package.json' assert { type: 'json' }
    ```

In addition, adding `assert { type: 'json' }` to an import statement now
means esbuild will generate an error if the loader for the file is
anything other than `json`, which is required by the import assertion
specification.

- Provide a way to disable automatic escaping of `</script>`
([#&#8203;2649](https://togithub.com/evanw/esbuild/issues/2649))

If you inject esbuild's output into a script tag in an HTML file, code
containing the literal characters `</script>` will cause the tag to be
ended early which will break the code:

    ```html
    <script>
      console.log("</script>");
    </script>
    ```

To avoid this, esbuild automatically escapes these strings in generated
JavaScript files (e.g. `"</script>"` becomes `"<\/script>"` instead).
This also applies to `</style>` in generated CSS files. Previously this
always happened and there wasn't a way to turn this off.

With this release, esbuild will now only do this if the `platform`
setting is set to `browser` (the default value). Setting `platform` to
`node` or `neutral` will disable this behavior. This behavior can also
now be disabled with `--supported:inline-script=false` (for JS) and
`--supported:inline-style=false` (for CSS).

- Throw an early error if decoded UTF-8 text isn't a `Uint8Array`
([#&#8203;2532](https://togithub.com/evanw/esbuild/issues/2532))

If you run esbuild's JavaScript API in a broken JavaScript environment
where `new TextEncoder().encode("") instanceof Uint8Array` is false,
then esbuild's API will fail with a confusing serialization error
message that makes it seem like esbuild has a bug even though the real
problem is that the JavaScript environment itself is broken. This can
happen when using the test framework called [Jest](https://jestjs.io/).
With this release, esbuild's API will now throw earlier when it detects
that the environment is unable to encode UTF-8 text correctly with an
error message that makes it more clear that this is not a problem with
esbuild.

-   Change the default "legal comment" behavior

The legal comments feature automatically gathers comments containing
`@license` or `@preserve` and puts the comments somewhere (either in the
generated code or in a separate file). People sometimes want this to
happen so that the their dependencies' software licenses are retained in
the generated output code. By default esbuild puts these comments at the
end of the file when bundling. However, people sometimes find this
confusing because these comments can be very generic and may not mention
which library they come from. So with this release, esbuild will now
discard legal comments by default. You now have to opt-in to preserving
them if you want this behavior.

- Enable the `module` condition by default
([#&#8203;2417](https://togithub.com/evanw/esbuild/issues/2417))

Package authors want to be able to use the new
[`exports`](https://nodejs.org/api/packages.html#conditional-exports)
field in `package.json` to provide tree-shakable ESM code for ESM-aware
bundlers while simultaneously providing fallback CommonJS code for other
cases.

Node's proposed way to do this involves using the `import` and `require`
export conditions so that you get the ESM code if you use an import
statement and the CommonJS code if you use a require call. However, this
has a major drawback: if some code in the bundle uses an import
statement and other code in the bundle uses a require call, then you'll
get two copies of the same package in the bundle. This is known as the
[dual package
hazard](https://nodejs.org/api/packages.html#dual-package-hazard) and
can lead to bloated bundles or even worse to subtle logic bugs.

Webpack supports an alternate solution: an export condition called
`module` that takes effect regardless of whether the package was
imported using an import statement or a require call. This works because
bundlers such as Webpack support importing a ESM using a require call
(something node doesn't support). You could already do this with esbuild
using `--conditions=module` but you previously had to explicitly enable
this. Package authors are concerned that esbuild users won't know to do
this and will get suboptimal output with their package, so they have
requested for esbuild to do this automatically.

So with this release, esbuild will now automatically add the `module`
condition when there aren't any custom `conditions` already configured.
You can disable this with `--conditions=` or `conditions: []` (i.e.
explicitly clearing all custom conditions).

-   Rename the `master` branch to `main`

The primary branch for this repository was previously called `master`
but is now called `main`. This change mirrors a similar change in many
other projects.

- Remove esbuild's `_exit(0)` hack for WebAssembly
([#&#8203;714](https://togithub.com/evanw/esbuild/issues/714))

Node had an unfortunate bug where the node process is unnecessarily kept
open while a WebAssembly module is being optimized:
[https://github.com/nodejs/node/issues/36616](https://togithub.com/nodejs/node/issues/36616).
This means cases where running `esbuild` should take a few milliseconds
can end up taking many seconds instead.

The workaround was to force node to exit by ending the process early.
This was done by esbuild in one of two ways depending on the exit code.
For non-zero exit codes (i.e. when there is a build error), the
`esbuild` command could just call `process.kill(process.pid)` to avoid
the hang. But for zero exit codes, esbuild had to load a N-API native
node extension that calls the operating system's `exit(0)` function.

However, this problem has essentially been fixed in node starting with
version 18.3.0. So I have removed this hack from esbuild. If you are
using an earlier version of node with `esbuild-wasm` and you don't want
the `esbuild` command to hang for a while when exiting, you can upgrade
to node 18.3.0 or higher to remove the hang.

The fix came from a V8 upgrade: [this
commit](https://togithub.com/v8/v8/commit/bfe12807c14c91714c7db1485e6b265439375e16)
enabled [dynamic tiering for
WebAssembly](https://v8.dev/blog/wasm-dynamic-tiering) by default for
all projects that use V8's WebAssembly implementation. Previously all
functions in the WebAssembly module were optimized in a single batch job
but with dynamic tiering, V8 now optimizes individual WebAssembly
functions as needed. This avoids unnecessary WebAssembly compilation
which allows node to exit on time.

###
[`v0.15.18`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;01518)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.17...v0.15.18)

-   Performance improvements for both JS and CSS

This release brings noticeable performance improvements for JS parsing
and for CSS parsing and printing. Here's an example benchmark for using
esbuild to pretty-print a single large minified CSS file and JS file:

    | Test case      | Previous release | This release       |
    |----------------|------------------|--------------------|
    | 4.8mb CSS file | 19ms             | 11ms (1.7x faster) |
    | 5.8mb JS file  | 36ms             | 32ms (1.1x faster) |

    The performance improvements were very straightforward:

- Identifiers were being scanned using a generic character advancement
function instead of using custom inline code. Advancing past each
character involved UTF-8 decoding as well as updating multiple member
variables. This was sped up using loop that skips UTF-8 decoding
entirely and that only updates member variables once at the end. This is
faster because identifiers are plain ASCII in the vast majority of
cases, so Unicode decoding is almost always unnecessary.

- CSS identifiers and CSS strings were still being printed one character
at a time. Apparently I forgot to move this part of esbuild's CSS
infrastructure beyond the proof-of-concept stage. These were both very
obvious in the profiler, so I think maybe I have just never profiled
esbuild's CSS printing before?

- There was unnecessary work being done that was related to source maps
when source map output was disabled. I likely haven't observed this
before because esbuild's benchmarks always have source maps enabled.
This work is now disabled when it's not going to be used.

I definitely should have caught these performance issues earlier. Better
late than never I suppose.

###
[`v0.15.17`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;01517)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.16...v0.15.17)

- Search for missing source map code on the file system
([#&#8203;2711](https://togithub.com/evanw/esbuild/issues/2711))

[Source maps](https://sourcemaps.info/spec.html) are JSON files that map
from compiled code back to the original code. They provide the original
source code using two arrays: `sources` (required) and `sourcesContent`
(optional). When bundling is enabled, esbuild is able to bundle code
with source maps that was compiled by other tools (e.g. with Webpack)
and emit source maps that map all the way back to the original code
(e.g. before Webpack compiled it).

Previously if the input source maps omitted the optional
`sourcesContent` array, esbuild would use `null` for the source content
in the source map that it generates (since the source content isn't
available). However, sometimes the original source code is actually
still present on the file system. With this release, esbuild will now
try to find the original source code using the path in the `sources`
array and will use that instead of `null` if it was found.

- Fix parsing bug with TypeScript `infer` and `extends`
([#&#8203;2712](https://togithub.com/evanw/esbuild/issues/2712))

This release fixes a bug where esbuild incorrectly failed to parse valid
TypeScript code that nests `extends` inside `infer` inside `extends`,
such as in the example below:

    ```ts
    type A<T> = {};
    type B = {} extends infer T extends {} ? A<T> : never;
    ```

    TypeScript code that does this should now be parsed correctly.

- Use `WebAssembly.instantiateStreaming` if available
([#&#8203;1036](https://togithub.com/evanw/esbuild/pull/1036),
[#&#8203;1900](https://togithub.com/evanw/esbuild/pull/1900))

Currently the WebAssembly version of esbuild uses `fetch` to download
`esbuild.wasm` and then `WebAssembly.instantiate` to compile it. There
is a newer API called `WebAssembly.instantiateStreaming` that both
downloads and compiles at the same time, which can be a performance
improvement if both downloading and compiling are slow. With this
release, esbuild now attempts to use `WebAssembly.instantiateStreaming`
and falls back to the original approach if that fails.

The implementation for this builds on a PR by
[@&#8203;lbwa](https://togithub.com/lbwa).

- Preserve Webpack comments inside constructor calls
([#&#8203;2439](https://togithub.com/evanw/esbuild/issues/2439))

This improves the use of esbuild as a faster TypeScript-to-JavaScript
frontend for Webpack, which has special [magic
comments](https://webpack.js.org/api/module-methods/#magic-comments)
inside `new Worker()` expressions that affect Webpack's behavior.

###
[`v0.15.16`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;01516)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.15...v0.15.16)

- Add a package alias feature
([#&#8203;2191](https://togithub.com/evanw/esbuild/issues/2191))

With this release, you can now easily substitute one package for another
at build time with the new `alias` feature. For example,
`--alias:oldpkg=newpkg` replaces all imports of `oldpkg` with `newpkg`.
One use case for this is easily replacing a node-only package with a
browser-friendly package in 3rd-party code that you don't control. These
new substitutions happen first before all of esbuild's existing path
resolution logic.

Note that when an import path is substituted using an alias, the
resulting import path is resolved in the working directory instead of in
the directory containing the source file with the import path. If
needed, the working directory can be set with the `cd` command when
using the CLI or with the `absWorkingDir` setting when using the JS or
Go APIs.

- Fix crash when pretty-printing minified JSX with object spread of
object literal with computed property
([#&#8203;2697](https://togithub.com/evanw/esbuild/issues/2697))

JSX elements are translated to JavaScript function calls and JSX element
attributes are translated to properties on a JavaScript object literal.
These properties are always either strings (e.g. in `<x y />`, `y` is a
string) or an object spread (e.g. in `<x {...y} />`, `y` is an object
spread) because JSX doesn't provide syntax for directly passing a
computed property as a JSX attribute. However, esbuild's minifier has a
rule that tries to inline object spread with an inline object literal in
JavaScript. For example, `x = { ...{ y } }` is minified to `x={y}` when
minification is enabled. This means that there is a way to generate a
non-string non-spread JSX attribute in esbuild's internal
representation. One example is with `<x {...{ [y]: z }} />`. When
minification is enabled, esbuild's internal representation of this is
something like `<x [y]={z} />` due to object spread inlining, which is
not valid JSX syntax. If this internal representation is then
pretty-printed as JSX using `--minify --jsx=preserve`, esbuild
previously crashed when trying to print this invalid syntax. With this
release, esbuild will now print `<x {...{[y]:z}}/>` in this scenario
instead of crashing.

###
[`v0.15.15`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;01515)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.14...v0.15.15)

- Remove duplicate CSS rules across files
([#&#8203;2688](https://togithub.com/evanw/esbuild/issues/2688))

When two or more CSS rules are exactly the same (even if they are not
adjacent), all but the last one can safely be removed:

    ```css
    /* Before */
    a { color: red; }
    span { font-weight: bold; }
    a { color: red; }

    /* After */
    span { font-weight: bold; }
    a { color: red; }
    ```

Previously esbuild only did this transformation within a single source
file. But with this release, esbuild will now do this transformation
across source files, which may lead to smaller CSS output if the same
rules are repeated across multiple CSS source files in the same bundle.
This transformation is only enabled when minifying (specifically when
syntax minification is enabled).

- Add `deno` as a valid value for `target`
([#&#8203;2686](https://togithub.com/evanw/esbuild/issues/2686))

The `target` setting in esbuild allows you to enable or disable
JavaScript syntax features for a given version of a set of target
JavaScript VMs. Previously [Deno](https://deno.land/) was not one of the
JavaScript VMs that esbuild supported with `target`, but it will now be
supported starting from this release. For example, versions of Deno
older than v1.2 don't support the new `||=` operator, so adding e.g.
`--target=deno1.0` to esbuild now lets you tell esbuild to transpile
`||=` to older JavaScript.

- Fix the `esbuild-wasm` package in Node v19
([#&#8203;2683](https://togithub.com/evanw/esbuild/issues/2683))

A recent change to Node v19 added a non-writable `crypto` property to
the global object:
[https://github.com/nodejs/node/pull/44897](https://togithub.com/nodejs/node/pull/44897).
This conflicts with Go's WebAssembly shim code, which overwrites the
global `crypto` property. As a result, all Go-based WebAssembly code
that uses the built-in shim (including esbuild) is now broken on Node
v19. This release of esbuild fixes the issue by reconfiguring the global
`crypto` property to be writable before invoking Go's WebAssembly shim
code.

- Fix CSS dimension printing exponent confusion edge case
([#&#8203;2677](https://togithub.com/evanw/esbuild/issues/2677))

In CSS, a dimension token has a numeric "value" part and an identifier
"unit" part. For example, the dimension token `32px` has a value of `32`
and a unit of `px`. The unit can be any valid CSS identifier. The value
can be any number in floating-point format including an optional
exponent (e.g. `-3.14e-0` has an exponent of `e-0`). The full details of
this syntax are here: https://www.w3.org/TR/css-syntax-3/.

To maintain the integrity of the dimension token through the printing
process, esbuild must handle the edge case where the unit looks like an
exponent. One such case is the dimension `1e\32` which has the value `1`
and the unit `e2`. It would be bad if this dimension token was printed
such that a CSS parser would parse it as a number token with the value
`1e2` instead of a dimension token. The way esbuild currently does this
is to escape the leading `e` in the dimension unit, so esbuild would
parse `1e\32` but print `1\65 2` (both `1e\32` and `1\65 2` represent a
dimension token with a value of `1` and a unit of `e2`).

However, there is an even narrower edge case regarding this edge case.
If the value part of the dimension token itself has an `e`, then it's
not necessary to escape the `e` in the dimension unit because a CSS
parser won't confuse the unit with the exponent even though it looks
like one (since a number can only have at most one exponent). This came
up because the grammar for the CSS `unicode-range` property uses a hack
that lets you specify a hexadecimal range without quotes even though CSS
has no token for a hexadecimal range. The hack is to allow the
hexadecimal range to be parsed as a dimension token and optionally also
a number token. Here is the grammar for `unicode-range`:

        unicode-range =
          <urange>#

        <urange> =
          u '+' <ident-token> '?'*            |
          u <dimension-token> '?'*            |
          u <number-token> '?'*               |
          u <number-token> <dimension-token>  |
          u <number-token> <number-token>     |
          u '+' '?'+

and here is an example `unicode-range` declaration that was problematic
for esbuild:

    ```css
    @&#8203;font-face {
      unicode-range: U+0e2e-0e2f;
    }
    ```

This is parsed as a dimension with a value of `+0e2` and a unit of
`e-0e2f`. This was problematic for esbuild because the unit starts with
`e-0` which could be confused with an exponent when appended after a
number, so esbuild was escaping the `e` character in the unit. However,
this escaping is unnecessary because in this case the dimension value
already has an exponent in it. With this release, esbuild will no longer
unnecessarily escape the `e` in the dimension unit in these cases, which
should fix the printing of `unicode-range` declarations.

An aside: You may be wondering why esbuild is trying to escape the `e`
at all and why it doesn't just pass through the original source code
unmodified. The reason why esbuild does this is that, for robustness,
esbuild's AST generally tries to omit semantically-unrelated information
and esbuild's code printers always try to preserve the semantics of the
underlying AST. That way the rest of esbuild's internals can just deal
with semantics instead of presentation. They don't have to think about
how the AST will be printed when changing the AST. This is the same
reason that esbuild's JavaScript AST doesn't have a "parentheses" node
(e.g. `a * (b + c)` is represented by the AST `multiply(a, add(b, c))`
instead of `multiply(a, parentheses(add(b, c)))`). Instead, the printer
automatically inserts parentheses as necessary to maintain the semantics
of the AST, which means all of the optimizations that run over the AST
don't have to worry about keeping the parentheses up to date. Similarly,
the CSS AST for the dimension token stores the actual unit and the
printer makes sure the unit is properly escaped depending on what value
it's placed after. All of the other code operating on CSS ASTs doesn't
have to worry about parsing escapes to compare units or about keeping
escapes up to date when the AST is modified. Hopefully that makes sense.

- Attempt to avoid creating the `node_modules/.cache` directory for
people that use Yarn 2+ in Plug'n'Play mode
([#&#8203;2685](https://togithub.com/evanw/esbuild/issues/2685))

When Yarn's PnP mode is enabled, packages installed by Yarn may or may
not be put inside `.zip` files. The specific heuristics for when this
happens change over time in between Yarn versions. This is problematic
for esbuild because esbuild's JavaScript package needs to execute a
binary file inside the package. Yarn makes extensive modifications to
Node's file system APIs at run time to pretend that `.zip` files are
normal directories and to make it hard to tell whether a file is real or
not (since in theory it doesn't matter). But they haven't modified
Node's `child_process.execFileSync` API so attempting to execute a file
inside a zip file fails. To get around this, esbuild previously used
Node's file system APIs to copy the binary executable to another
location before invoking `execFileSync`. Under the hood this caused Yarn
to extract the file from the zip file into a real file that can then be
run.

However, esbuild copied its executable into
`node_modules/.cache/esbuild`. This is the [official recommendation from
the Yarn
team](https://yarnpkg.com/advanced/rulebook/#packages-should-never-write-inside-their-own-folder-outside-of-postinstall)
for where packages are supposed to put these types of files when Yarn
PnP is being used. However, users of Yarn PnP with esbuild find this
really annoying because they don't like looking at the `node_modules`
directory. With this release, esbuild now sets `"preferUnplugged": true`
in its `package.json` files, which tells newer versions of Yarn to not
put esbuild's packages in a zip file. There may exist older versions of
Yarn that don't support `preferUnplugged`. In that case esbuild should
still copy the executable to a cache directory, so it should still run
(hopefully, since I haven't tested this myself). Note that esbuild
setting `"preferUnplugged": true` may have the side effect of esbuild
taking up more space on the file system in the event that multiple
platforms are installed simultaneously, or that you're using an older
version of Yarn that always installs packages for all platforms. In that
case you may want to update to a newer version of Yarn since Yarn has
recently changed to only install packages for the current platform.

###
[`v0.15.14`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;01514)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.13...v0.15.14)

- Fix parsing of TypeScript `infer` inside a conditional `extends`
([#&#8203;2675](https://togithub.com/evanw/esbuild/issues/2675))

Unlike JavaScript, parsing TypeScript sometimes requires backtracking.
The `infer A` type operator can take an optional constraint of the form
`infer A extends B`. However, this syntax conflicts with the similar
conditional type operator `A extends B ? C : D` in cases where the
syntax is combined, such as `infer A extends B ? C : D`. This is
supposed to be parsed as `(infer A) extends B ? C : D`. Previously
esbuild incorrectly parsed this as `(infer A extends B) ? C : D`
instead, which is a parse error since the `?:` conditional operator
requires the `extends` keyword as part of the conditional type.
TypeScript disambiguates by speculatively parsing the `extends` after
the `infer`, but backtracking if a `?` token is encountered afterward.
With this release, esbuild should now do the same thing, so esbuild
should now correctly parse these types. Here's a real-world example of
such a type:

    ```ts
type Normalized<T> = T extends Array<infer A extends object ? infer A :
never>
      ? Dictionary<Normalized<A>>
      : {
[P in keyof T]: T[P] extends Array<infer A extends object ? infer A :
never>
            ? Dictionary<Normalized<A>>
            : Normalized<T[P]>
        }
    ```

- Avoid unnecessary watch mode rebuilds when debug logging is enabled
([#&#8203;2661](https://togithub.com/evanw/esbuild/issues/2661))

When debug-level logs are enabled (such as with `--log-level=debug`),
esbuild's path resolution subsystem generates debug log messages that
say something like "Read 20 entries for directory /home/user" to help
you debug what esbuild's path resolution is doing. This caused esbuild's
watch mode subsystem to add a dependency on the full list of entries in
that directory since if that changes, the generated log message would
also have to be updated. However, meant that on systems where a parent
directory undergoes constant directory entry churn, esbuild's watch mode
would continue to rebuild if `--log-level=debug` was passed.

With this release, these debug log messages are now generated by
"peeking" at the file system state while bypassing esbuild's watch mode
dependency tracking. So now watch mode doesn't consider the count of
directory entries in these debug log messages to be a part of the build
that needs to be kept up to date when the file system state changes.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/ajvpot/lockfileparsergo).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC40OS4wIiwidXBkYXRlZEluVmVyIjoiMzQuNDkuMCJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>
toddbaert referenced this issue in open-feature/js-sdk Dec 7, 2022
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [esbuild](https://togithub.com/evanw/esbuild) | [`^0.15.1` ->
`^0.16.0`](https://renovatebot.com/diffs/npm/esbuild/0.15.18/0.16.1) |
[![age](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/age-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/adoption-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/compatibility-slim/0.15.18)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://badges.renovateapi.com/packages/npm/esbuild/0.16.1/confidence-slim/0.15.18)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>evanw/esbuild</summary>

###
[`v0.16.1`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0161)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.0...v0.16.1)

This is a hotfix for the previous release.

- Re-allow importing JSON with the `copy` loader using an import
assertion

The previous release made it so when `assert { type: 'json' }` is
present on an import statement, esbuild validated that the `json` loader
was used. This is what an import assertion is supposed to do. However, I
forgot about the relatively new `copy` loader, which sort of behaves as
if the import path was marked as external (and thus not loaded at all)
except that the file is copied to the output directory and the import
path is rewritten to point to the copy. In this case whatever JavaScript
runtime ends up running the code is the one to evaluate the import
assertion. So esbuild should really allow this case as well. With this
release, esbuild now allows both the `json` and `copy` loaders when an
`assert { type: 'json' }` import assertion is present.

###
[`v0.16.0`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0160)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.18...v0.16.0)

**This release deliberately contains backwards-incompatible changes.**
To avoid automatically picking up releases like this, you should either
be pinning the exact version of `esbuild` in your `package.json` file
(recommended) or be using a version range syntax that only accepts patch
upgrades such as `~0.15.0`. See npm's documentation about
[semver](https://docs.npmjs.com/cli/v6/using-npm/semver/) for more
information.

-   Move all binary executable packages to the `@esbuild/` scope

Binary package executables for esbuild are published as individual
packages separate from the main `esbuild` package so you only have to
download the relevant one for the current platform when you install
esbuild. This release moves all of these packages under the `@esbuild/`
scope to avoid collisions with 3rd-party packages. It also changes them
to a consistent naming scheme that uses the `os` and `cpu` names from
node.

    The package name changes are as follows:

    -   `@esbuild/linux-loong64` => `@esbuild/linux-loong64` (no change)
    -   `esbuild-android-64` => `@esbuild/android-x64`
    -   `esbuild-android-arm64` => `@esbuild/android-arm64`
    -   `esbuild-darwin-64` => `@esbuild/darwin-x64`
    -   `esbuild-darwin-arm64` => `@esbuild/darwin-arm64`
    -   `esbuild-freebsd-64` => `@esbuild/freebsd-x64`
    -   `esbuild-freebsd-arm64` => `@esbuild/freebsd-arm64`
    -   `esbuild-linux-32` => `@esbuild/linux-ia32`
    -   `esbuild-linux-64` => `@esbuild/linux-x64`
    -   `esbuild-linux-arm` => `@esbuild/linux-arm`
    -   `esbuild-linux-arm64` => `@esbuild/linux-arm64`
    -   `esbuild-linux-mips64le` => `@esbuild/linux-mips64el`
    -   `esbuild-linux-ppc64le` => `@esbuild/linux-ppc64`
    -   `esbuild-linux-riscv64` => `@esbuild/linux-riscv64`
    -   `esbuild-linux-s390x` => `@esbuild/linux-s390x`
    -   `esbuild-netbsd-64` => `@esbuild/netbsd-x64`
    -   `esbuild-openbsd-64` => `@esbuild/openbsd-x64`
    -   `esbuild-sunos-64` => `@esbuild/sunos-x64`
    -   `esbuild-wasm` => `esbuild-wasm` (no change)
    -   `esbuild-windows-32` => `@esbuild/win32-ia32`
    -   `esbuild-windows-64` => `@esbuild/win32-x64`
    -   `esbuild-windows-arm64` => `@esbuild/win32-arm64`
    -   `esbuild` => `esbuild` (no change)

Normal usage of the `esbuild` and `esbuild-wasm` packages should not be
affected. These name changes should only affect tools that hard-coded
the individual binary executable package names into custom esbuild
downloader scripts.

This change was not made with performance in mind. But as a bonus,
installing esbuild with npm may potentially happen faster now. This is
because npm's package installation protocol is inefficient: it always
downloads metadata for all past versions of each package even when it
only needs metadata about a single version. This makes npm package
downloads O(n) in the number of published versions, which penalizes
packages like esbuild that are updated regularly. Since most of
esbuild's package names have now changed, npm will now need to download
much less data when installing esbuild (8.72mb of package manifests
before this change → 0.06mb of package manifests after this change).
However, this is only a temporary improvement. Installing esbuild will
gradually get slower again as further versions of esbuild are published.

-   Publish a shell script that downloads esbuild directly

In addition to all of the existing ways to install esbuild, you can now
also download esbuild directly like this:

    ```sh
    curl -fsSL https://esbuild.github.io/dl/latest | sh
    ```

This runs a small shell script that downloads the latest `esbuild`
binary executable to the current directory. This can be convenient on
systems that don't have `npm` installed or when you just want to get a
copy of esbuild quickly without any extra steps. If you want a specific
version of esbuild (starting with this version onward), you can provide
that version in the URL instead of `latest`:

    ```sh
    curl -fsSL https://esbuild.github.io/dl/v0.16.0 | sh
    ```

Note that the download script needs to be able to access
registry.npmjs.org to be able to complete the download. This download
script doesn't yet support all of the platforms that esbuild supports
because I lack the necessary testing environments. If the download
script doesn't work for you because you're on an unsupported platform,
please file an issue on the esbuild repo so we can add support for it.

-   Fix some parameter names for the Go API

This release changes some parameter names for the Go API to be
consistent with the JavaScript and CLI APIs:

    -   `OutExtensions` => `OutExtension`
    -   `JSXMode` => `JSX`

-   Add additional validation of API parameters

The JavaScript API now does some additional validation of API parameters
to catch incorrect uses of esbuild's API. The biggest impact of this is
likely that esbuild now strictly only accepts strings with the `define`
parameter. This would already have been a type error with esbuild's
TypeScript type definitions, but it was previously not enforced for
people using esbuild's API JavaScript without TypeScript.

The `define` parameter appears at first glance to take a JSON object if
you aren't paying close attention, but this actually isn't true. Values
for `define` are instead strings of JavaScript code. This means you have
to use `define: { foo: '"bar"' }` to replace `foo` with the string
`"bar"`. Using `define: { foo: 'bar' }` actually replaces `foo` with the
identifier `bar`. Previously esbuild allowed you to pass `define: { foo:
false }` and `false` was automatically converted into a string, which
made it more confusing to understand what `define` actually represents.
Starting with this release, passing non-string values such as with
`define: { foo: false }` will no longer be allowed. You will now have to
write `define: { foo: 'false' }` instead.

- Generate shorter data URLs if possible
([#&#8203;1843](https://togithub.com/evanw/esbuild/issues/1843))

Loading a file with esbuild's `dataurl` loader generates a JavaScript
module with a [data
URL](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URLs)
for that file in a string as a single default export. Previously the
data URLs generated by esbuild all used [base64
encoding](https://en.wikipedia.org/wiki/Base64). However, this is
unnecessarily long for most textual data (e.g. SVG images). So with this
release, esbuild's `dataurl` loader will now use percent encoding
instead of base64 encoding if the result will be shorter. This can
result in ~25% smaller data URLs for large SVGs. If you want the old
behavior, you can use the `base64` loader instead and then construct the
data URL yourself.

- Avoid marking entry points as external
([#&#8203;2382](https://togithub.com/evanw/esbuild/issues/2382))

Previously you couldn't specify `--external:*` to mark all import paths
as external because that also ended up making the entry point itself
external, which caused the build to fail. With this release, esbuild's
`external` API parameter no longer applies to entry points so using
`--external:*` is now possible.

One additional consequence of this change is that the `kind` parameter
is now required when calling the `resolve()` function in esbuild's
plugin API. Previously the `kind` parameter defaulted to `entry-point`,
but that no longer interacts with `external` so it didn't seem wise for
this to continue to be the default. You now have to specify `kind` so
that the path resolution mode is explicit.

- Disallow non-`default` imports when `assert { type: 'json' }` is
present

There is now standard behavior for importing a JSON file into an ES
module using an `import` statement. However, it requires you to place
the `assert { type: 'json' }` import assertion after the import path.
This import assertion tells the JavaScript runtime to throw an error if
the import does not end up resolving to a JSON file. On the web, the
type of a file is determined by the `Content-Type` HTTP header instead
of by the file extension. The import assertion prevents security
problems on the web where a `.json` file may actually resolve to a
JavaScript file containing malicious code, which is likely not expected
for an import that is supposed to only contain pure side-effect free
data.

By default, esbuild uses the file extension to determine the type of a
file, so this import assertion is unnecessary with esbuild. However,
esbuild's JSON import feature has a non-standard extension that allows
you to import top-level properties of the JSON object as named imports.
For example, esbuild lets you do this:

    ```js
    import { version } from './package.json'
    ```

This is useful for tree-shaking when bundling because it means esbuild
will only include the the `version` field of `package.json` in your
bundle. This is non-standard behavior though and doesn't match the
behavior of what happens when you import JSON in a real JavaScript
runtime (after adding `assert { type: 'json' }`). In a real JavaScript
runtime the only thing you can import is the `default` import. So with
this release, esbuild will now prevent you from importing non-`default`
import names if `assert { type: 'json' }` is present. This ensures that
code containing `assert { type: 'json' }` isn't relying on non-standard
behavior that won't work everywhere. So the following code is now an
error with esbuild when bundling:

    ```js
    import { version } from './package.json' assert { type: 'json' }
    ```

In addition, adding `assert { type: 'json' }` to an import statement now
means esbuild will generate an error if the loader for the file is
anything other than `json`, which is required by the import assertion
specification.

- Provide a way to disable automatic escaping of `</script>`
([#&#8203;2649](https://togithub.com/evanw/esbuild/issues/2649))

If you inject esbuild's output into a script tag in an HTML file, code
containing the literal characters `</script>` will cause the tag to be
ended early which will break the code:

    ```html
    <script>
      console.log("</script>");
    </script>
    ```

To avoid this, esbuild automatically escapes these strings in generated
JavaScript files (e.g. `"</script>"` becomes `"<\/script>"` instead).
This also applies to `</style>` in generated CSS files. Previously this
always happened and there wasn't a way to turn this off.

With this release, esbuild will now only do this if the `platform`
setting is set to `browser` (the default value). Setting `platform` to
`node` or `neutral` will disable this behavior. This behavior can also
now be disabled with `--supported:inline-script=false` (for JS) and
`--supported:inline-style=false` (for CSS).

- Throw an early error if decoded UTF-8 text isn't a `Uint8Array`
([#&#8203;2532](https://togithub.com/evanw/esbuild/issues/2532))

If you run esbuild's JavaScript API in a broken JavaScript environment
where `new TextEncoder().encode("") instanceof Uint8Array` is false,
then esbuild's API will fail with a confusing serialization error
message that makes it seem like esbuild has a bug even though the real
problem is that the JavaScript environment itself is broken. This can
happen when using the test framework called [Jest](https://jestjs.io/).
With this release, esbuild's API will now throw earlier when it detects
that the environment is unable to encode UTF-8 text correctly with an
error message that makes it more clear that this is not a problem with
esbuild.

-   Change the default "legal comment" behavior

The legal comments feature automatically gathers comments containing
`@license` or `@preserve` and puts the comments somewhere (either in the
generated code or in a separate file). People sometimes want this to
happen so that the their dependencies' software licenses are retained in
the generated output code. By default esbuild puts these comments at the
end of the file when bundling. However, people sometimes find this
confusing because these comments can be very generic and may not mention
which library they come from. So with this release, esbuild will now
discard legal comments by default. You now have to opt-in to preserving
them if you want this behavior.

- Enable the `module` condition by default
([#&#8203;2417](https://togithub.com/evanw/esbuild/issues/2417))

Package authors want to be able to use the new
[`exports`](https://nodejs.org/api/packages.html#conditional-exports)
field in `package.json` to provide tree-shakable ESM code for ESM-aware
bundlers while simultaneously providing fallback CommonJS code for other
cases.

Node's proposed way to do this involves using the `import` and `require`
export conditions so that you get the ESM code if you use an import
statement and the CommonJS code if you use a require call. However, this
has a major drawback: if some code in the bundle uses an import
statement and other code in the bundle uses a require call, then you'll
get two copies of the same package in the bundle. This is known as the
[dual package
hazard](https://nodejs.org/api/packages.html#dual-package-hazard) and
can lead to bloated bundles or even worse to subtle logic bugs.

Webpack supports an alternate solution: an export condition called
`module` that takes effect regardless of whether the package was
imported using an import statement or a require call. This works because
bundlers such as Webpack support importing a ESM using a require call
(something node doesn't support). You could already do this with esbuild
using `--conditions=module` but you previously had to explicitly enable
this. Package authors are concerned that esbuild users won't know to do
this and will get suboptimal output with their package, so they have
requested for esbuild to do this automatically.

So with this release, esbuild will now automatically add the `module`
condition when there aren't any custom `conditions` already configured.
You can disable this with `--conditions=` or `conditions: []` (i.e.
explicitly clearing all custom conditions).

-   Rename the `master` branch to `main`

The primary branch for this repository was previously called `master`
but is now called `main`. This change mirrors a similar change in many
other projects.

- Remove esbuild's `_exit(0)` hack for WebAssembly
([#&#8203;714](https://togithub.com/evanw/esbuild/issues/714))

Node had an unfortunate bug where the node process is unnecessarily kept
open while a WebAssembly module is being optimized:
[https://github.com/nodejs/node/issues/36616](https://togithub.com/nodejs/node/issues/36616).
This means cases where running `esbuild` should take a few milliseconds
can end up taking many seconds instead.

The workaround was to force node to exit by ending the process early.
This was done by esbuild in one of two ways depending on the exit code.
For non-zero exit codes (i.e. when there is a build error), the
`esbuild` command could just call `process.kill(process.pid)` to avoid
the hang. But for zero exit codes, esbuild had to load a N-API native
node extension that calls the operating system's `exit(0)` function.

However, this problem has essentially been fixed in node starting with
version 18.3.0. So I have removed this hack from esbuild. If you are
using an earlier version of node with `esbuild-wasm` and you don't want
the `esbuild` command to hang for a while when exiting, you can upgrade
to node 18.3.0 or higher to remove the hang.

The fix came from a V8 upgrade: [this
commit](https://togithub.com/v8/v8/commit/bfe12807c14c91714c7db1485e6b265439375e16)
enabled [dynamic tiering for
WebAssembly](https://v8.dev/blog/wasm-dynamic-tiering) by default for
all projects that use V8's WebAssembly implementation. Previously all
functions in the WebAssembly module were optimized in a single batch job
but with dynamic tiering, V8 now optimizes individual WebAssembly
functions as needed. This avoids unnecessary WebAssembly compilation
which allows node to exit on time.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/open-feature/js-sdk).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC40OS4wIiwidXBkYXRlZEluVmVyIjoiMzQuNDkuMCJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fuxingloh referenced this issue in fuxingloh/contented Dec 15, 2022
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [esbuild](https://togithub.com/evanw/esbuild) | [`^0.15.18` ->
`^0.16.7`](https://renovatebot.com/diffs/npm/esbuild/0.15.18/0.16.7) |
[![age](https://badges.renovateapi.com/packages/npm/esbuild/0.16.7/age-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://badges.renovateapi.com/packages/npm/esbuild/0.16.7/adoption-slim)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://badges.renovateapi.com/packages/npm/esbuild/0.16.7/compatibility-slim/0.15.18)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://badges.renovateapi.com/packages/npm/esbuild/0.16.7/confidence-slim/0.15.18)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>evanw/esbuild</summary>

###
[`v0.16.7`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0167)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.6...v0.16.7)

- Include `file` loader strings in metafile imports
([#&#8203;2731](https://togithub.com/evanw/esbuild/issues/2731))

Bundling a file with the `file` loader copies that file to the output
directory and imports a module with the path to the copied file in the
`default` export. Previously when bundling with the `file` loader, there
was no reference in the metafile from the JavaScript file containing the
path string to the copied file. With this release, there will now be a
reference in the metafile in the `imports` array with the kind
`file-loader`:

    ```diff
     {
       ...
       "outputs": {
         "out/image-55CCFTCE.svg": {
           ...
         },
         "out/entry.js": {
           "imports": [
    +        {
    +          "path": "out/image-55CCFTCE.svg",
    +          "kind": "file-loader"
    +        }
           ],
           ...
         }
       }
     }
    ```

- Fix byte counts in metafile regarding references to other output files
([#&#8203;2071](https://togithub.com/evanw/esbuild/issues/2071))

Previously files that contained references to other output files had
slightly incorrect metadata for the byte counts of input files which
contributed to that output file. So for example if `app.js` imports
`image.png` using the file loader and esbuild generates `out.js` and
`image-LSAMBFUD.png`, the metadata for how many bytes of `out.js` are
from `app.js` was slightly off (the metadata for the byte count of
`out.js` was still correct). The reason is because esbuild substitutes
the final paths for references between output files toward the end of
the build to handle cyclic references, and the byte counts needed to be
adjusted as well during the path substitution. This release fixes these
byte counts (specifically the `bytesInOutput` values).

- The alias feature now strips a trailing slash
([#&#8203;2730](https://togithub.com/evanw/esbuild/issues/2730))

People sometimes add a trailing slash to the name of one of node's
built-in modules to force node to import from the file system instead of
importing the built-in module. For example, importing `util` imports
node's built-in module called `util` but importing `util/` tries to find
a package called `util` on the file system. Previously attempting to use
esbuild's package alias feature to replace imports to `util` with a
specific file would fail because the file path would also gain a
trailing slash (e.g. mapping `util` to `./file.js` turned `util/` into
`./file.js/`). With this release, esbuild will now omit the path suffix
if it's a single trailing slash, which should now allow you to
successfully apply aliases to these import paths.

###
[`v0.16.6`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0166)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.5...v0.16.6)

- Do not mark subpath imports as external with `--packages=external`
([#&#8203;2741](https://togithub.com/evanw/esbuild/issues/2741))

Node has a feature called [subpath
imports](https://nodejs.org/api/packages.html#subpath-imports) where
special import paths that start with `#` are resolved using the
`imports` field in the `package.json` file of the enclosing package. The
intent of the newly-added `--packages=external` setting is to exclude a
package's dependencies from the bundle. Since a package's subpath
imports are only accessible within that package, it's wrong for them to
be affected by `--packages=external`. This release changes esbuild so
that `--packages=external` no longer affects subpath imports.

-   Forbid invalid numbers in JSON files

Previously esbuild parsed numbers in JSON files using the same syntax as
JavaScript. But starting from this release, esbuild will now parse them
with JSON syntax instead. This means the following numbers are no longer
allowed by esbuild in JSON files:

    -   Legacy octal literals (non-zero integers starting with `0`)
    -   The `0b`, `0o`, and `0x` numeric prefixes
    -   Numbers containing `_` such as `1_000`
    -   Leading and trailing `.` such as `0.` and `.0`
    -   Numbers with a space after the `-` such as `- 1`

- Add external imports to metafile
([#&#8203;905](https://togithub.com/evanw/esbuild/issues/905),
[#&#8203;1768](https://togithub.com/evanw/esbuild/issues/1768),
[#&#8203;1933](https://togithub.com/evanw/esbuild/issues/1933),
[#&#8203;1939](https://togithub.com/evanw/esbuild/issues/1939))

External imports now appear in `imports` arrays in the metafile (which
is present when bundling with `metafile: true`) next to normal imports,
but additionally have `external: true` to set them apart. This applies
both to files in the `inputs` section and the `outputs` section. Here's
an example:

    ```diff
     {
       "inputs": {
         "style.css": {
           "bytes": 83,
           "imports": [
    +        {
+ "path":
"https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css",
    +          "kind": "import-rule",
    +          "external": true
    +        }
           ]
         },
         "app.js": {
           "bytes": 100,
           "imports": [
    +        {
+ "path":
"https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.min.js",
    +          "kind": "import-statement",
    +          "external": true
    +        },
             {
               "path": "style.css",
               "kind": "import-statement"
             }
           ]
         }
       },
       "outputs": {
         "out/app.js": {
           "imports": [
    +        {
+ "path":
"https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.min.js",
    +          "kind": "require-call",
    +          "external": true
    +        }
           ],
           "exports": [],
           "entryPoint": "app.js",
           "cssBundle": "out/app.css",
           "inputs": {
             "app.js": {
               "bytesInOutput": 113
             },
             "style.css": {
               "bytesInOutput": 0
             }
           },
           "bytes": 528
         },
         "out/app.css": {
           "imports": [
    +        {
+ "path":
"https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css",
    +          "kind": "import-rule",
    +          "external": true
    +        }
           ],
           "inputs": {
             "style.css": {
               "bytesInOutput": 0
             }
           },
           "bytes": 100
         }
       }
     }
    ```

One additional useful consequence of this is that the `imports` array is
now populated when bundling is disabled. So you can now use esbuild with
bundling disabled to inspect a file's imports.

###
[`v0.16.5`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0165)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.4...v0.16.5)

- Make it easy to exclude all packages from a bundle
([#&#8203;1958](https://togithub.com/evanw/esbuild/issues/1958),
[#&#8203;1975](https://togithub.com/evanw/esbuild/issues/1975),
[#&#8203;2164](https://togithub.com/evanw/esbuild/issues/2164),
[#&#8203;2246](https://togithub.com/evanw/esbuild/issues/2246),
[#&#8203;2542](https://togithub.com/evanw/esbuild/issues/2542))

When bundling for node, it's often necessary to exclude npm packages
from the bundle since they weren't designed with esbuild bundling in
mind and don't work correctly after being bundled. For example, they may
use `__dirname` and run-time file system calls to load files, which
doesn't work after bundling with esbuild. Or they may compile a native
`.node` extension that has similar expectations about the layout of the
file system that are no longer true after bundling (even if the `.node`
extension is copied next to the bundle).

The way to get this to work with esbuild is to use the `--external:`
flag. For example, the
[`fsevents`](https://www.npmjs.com/package/fsevents) package contains a
native `.node` extension and shouldn't be bundled. To bundle code that
uses it, you can pass `--external:fsevents` to esbuild to exclude it
from your bundle. You will then need to ensure that the `fsevents`
package is still present when you run your bundle (e.g. by publishing
your bundle to npm as a package with a dependency on `fsevents`).

It was possible to automatically do this for all of your dependencies,
but it was inconvenient. You had to write some code that read your
`package.json` file and passed the keys of the `dependencies`,
`devDependencies`, `peerDependencies`, and/or `optionalDependencies`
maps to esbuild as external packages (either that or write a plugin to
mark all package paths as external). Previously esbuild's recommendation
for making this easier was to do `--external:./node_modules/*` (added in
version 0.14.13). However, this was a bad idea because it caused
compatibility problems with many node packages as it caused esbuild to
mark the post-resolve path as external instead of the pre-resolve path.
Doing that could break packages that are published as both CommonJS and
ESM if esbuild's bundler is also used to do a module format conversion.

With this release, you can now do the following to automatically exclude
all packages from your bundle:

    -   CLI:

            esbuild --bundle --packages=external

    -   JS:

        ```js
        esbuild.build({
          bundle: true,
          packages: 'external',
        })
        ```

    -   Go:

        ```go
        api.Build(api.BuildOptions{
          Bundle:   true,
          Packages: api.PackagesExternal,
        })
        ```

Doing `--external:./node_modules/*` is still possible and still has the
same behavior, but is no longer recommended. I recommend that you use
the new `packages` feature instead.

-   Fix some subtle bugs with tagged template literals

This release fixes a bug where minification could incorrectly change the
value of `this` within tagged template literal function calls:

    ```js
    // Original code
    function f(x) {
      let z = y.z
      return z``
    }

    // Old output (with --minify)
    function f(n){return y.z``}

    // New output (with --minify)
    function f(n){return(0,y.z)``}
    ```

This release also fixes a bug where using optional chaining with
`--target=es2019` or earlier could incorrectly change the value of
`this` within tagged template literal function calls:

    ```js
    // Original code
    var obj = {
      foo: function() {
        console.log(this === obj);
      }
    };
    (obj?.foo)``;

    // Old output (with --target=es6)
    var obj = {
      foo: function() {
        console.log(this === obj);
      }
    };
    (obj == null ? void 0 : obj.foo)``;

    // New output (with --target=es6)
    var __freeze = Object.freeze;
    var __defProp = Object.defineProperty;
var __template = (cooked, raw) => __freeze(__defProp(cooked, "raw", {
value: __freeze(raw || cooked.slice()) }));
    var _a;
    var obj = {
      foo: function() {
        console.log(this === obj);
      }
    };
(obj == null ? void 0 : obj.foo).call(obj, _a || (_a =
__template([""])));
    ```

-   Some slight minification improvements

    The following minification improvements were implemented:

    -   `if (~a !== 0) throw x;` => `if (~a) throw x;`
    -   `if ((a | b) !== 0) throw x;` => `if (a | b) throw x;`
    -   `if ((a & b) !== 0) throw x;` => `if (a & b) throw x;`
    -   `if ((a ^ b) !== 0) throw x;` => `if (a ^ b) throw x;`
    -   `if ((a << b) !== 0) throw x;` => `if (a << b) throw x;`
    -   `if ((a >> b) !== 0) throw x;` => `if (a >> b) throw x;`
    -   `if ((a >>> b) !== 0) throw x;` => `if (a >>> b) throw x;`
    -   `if (!!a || !!b) throw x;` => `if (a || b) throw x;`
    -   `if (!!a && !!b) throw x;` => `if (a && b) throw x;`
    -   `if (a ? !!b : !!c) throw x;` => `if (a ? b : c) throw x;`

###
[`v0.16.4`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0164)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.3...v0.16.4)

- Fix binary downloads from the `@esbuild/` scope for Deno
([#&#8203;2729](https://togithub.com/evanw/esbuild/issues/2729))

Version 0.16.0 of esbuild moved esbuild's binary executables into npm
packages under the `@esbuild/` scope, which accidentally broke the
binary downloader script for Deno. This release fixes this script so it
should now be possible to use esbuild version 0.16.4+ with Deno.

###
[`v0.16.3`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0163)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.2...v0.16.3)

- Fix a hang with the JS API in certain cases
([#&#8203;2727](https://togithub.com/evanw/esbuild/issues/2727))

A change that was made in version 0.15.13 accidentally introduced a case
when using esbuild's JS API could cause the node process to fail to
exit. The change broke esbuild's watchdog timer, which detects if the
parent process no longer exists and then automatically exits esbuild.
This hang happened when you ran node as a child process with the
`stderr` stream set to `pipe` instead of `inherit`, in the child process
you call esbuild's JS API and pass `incremental: true` but do not call
`dispose()` on the returned `rebuild` object, and then call
`process.exit()`. In that case the parent node process was still waiting
for the esbuild process that was created by the child node process to
exit. The change made in version 0.15.13 was trying to avoid using Go's
`sync.WaitGroup` API incorrectly because the API is not thread-safe.
Instead of doing this, I have now reverted that change and implemented a
thread-safe version of the `sync.WaitGroup` API for esbuild to use
instead.

###
[`v0.16.2`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0162)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.1...v0.16.2)

- Fix `process.env.NODE_ENV` substitution when transforming
([#&#8203;2718](https://togithub.com/evanw/esbuild/issues/2718))

Version 0.16.0 introduced an unintentional regression that caused
`process.env.NODE_ENV` to be automatically substituted with either
`"development"` or `"production"` when using esbuild's `transform` API.
This substitution is a necessary feature of esbuild's `build` API
because the React framework crashes when you bundle it without doing
this. But the `transform` API is typically used as part of a larger
build pipeline so the benefit of esbuild doing this automatically is not
as clear, and esbuild previously didn't do this.

However, version 0.16.0 switched the default value of the `platform`
setting for the `transform` API from `neutral` to `browser`, both to
align it with esbuild's documentation (which says `browser` is the
default value) and because escaping the `</script>` character sequence
is now tied to the `browser` platform (see the release notes for version
0.16.0 for details). That accidentally enabled automatic substitution of
`process.env.NODE_ENV` because esbuild always did that for code meant
for the browser. To fix this regression, esbuild will now only
automatically substitute `process.env.NODE_ENV` when using the `build`
API.

- Prevent `define` from substituting constants into assignment position
([#&#8203;2719](https://togithub.com/evanw/esbuild/issues/2719))

The `define` feature lets you replace certain expressions with
constants. For example, you could use it to replace references to the
global property reference `window.DEBUG` with `false` at compile time,
which can then potentially help esbuild remove unused code from your
bundle. It's similar to
[DefinePlugin](https://webpack.js.org/plugins/define-plugin/) in
Webpack.

However, if you write code such as `window.DEBUG = true` and then
defined `window.DEBUG` to `false`, esbuild previously generated the
output `false = true` which is a syntax error in JavaScript. This
behavior is not typically a problem because it doesn't make sense to
substitute `window.DEBUG` with a constant if its value changes at
run-time (Webpack's `DefinePlugin` also generates `false = true` in this
case). But it can be alarming to have esbuild generate code with a
syntax error.

So with this release, esbuild will no longer substitute `define`
constants into assignment position to avoid generating code with a
syntax error. Instead esbuild will generate a warning, which currently
looks like this:

▲ [WARNING] Suspicious assignment to defined constant "window.DEBUG"
[assign-to-define]

            example.js:1:0:
              1 │ window.DEBUG = true
                ╵ ~~~~~~~~~~~~

The expression "window.DEBUG" has been configured to be replaced with a
constant using the
"define" feature. If this expression is supposed to be a compile-time
constant, then it doesn't
make sense to assign to it here. Or if this expression is supposed to
change at run-time, this
          "define" substitution should be removed.

- Fix a regression with `npm install --no-optional`
([#&#8203;2720](https://togithub.com/evanw/esbuild/issues/2720))

Normally when you install esbuild with `npm install`, npm itself is the
tool that downloads the correct binary executable for the current
platform. This happens because of how esbuild's primary package uses
npm's `optionalDependencies` feature. However, if you deliberately
disable this with `npm install --no-optional` then esbuild's install
script will attempt to repair the installation by manually downloading
and extracting the binary executable from the package that was supposed
to be installed.

The change in version 0.16.0 to move esbuild's nested packages into the
`@esbuild/` scope unintentionally broke this logic because of how npm's
URL structure is different for scoped packages vs. normal packages. It
was actually already broken for a few platforms earlier because esbuild
already had packages for some platforms in the `@esbuild/` scope, but I
didn't discover this then because esbuild's integration tests aren't run
on all platforms. Anyway, this release contains some changes to the
install script that should hopefully get this scenario working again.

###
[`v0.16.1`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0161)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.0...v0.16.1)

This is a hotfix for the previous release.

- Re-allow importing JSON with the `copy` loader using an import
assertion

The previous release made it so when `assert { type: 'json' }` is
present on an import statement, esbuild validated that the `json` loader
was used. This is what an import assertion is supposed to do. However, I
forgot about the relatively new `copy` loader, which sort of behaves as
if the import path was marked as external (and thus not loaded at all)
except that the file is copied to the output directory and the import
path is rewritten to point to the copy. In this case whatever JavaScript
runtime ends up running the code is the one to evaluate the import
assertion. So esbuild should really allow this case as well. With this
release, esbuild now allows both the `json` and `copy` loaders when an
`assert { type: 'json' }` import assertion is present.

###
[`v0.16.0`](https://togithub.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#&#8203;0160)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.18...v0.16.0)

**This release deliberately contains backwards-incompatible changes.**
To avoid automatically picking up releases like this, you should either
be pinning the exact version of `esbuild` in your `package.json` file
(recommended) or be using a version range syntax that only accepts patch
upgrades such as `^0.15.0` or `~0.15.0`. See npm's documentation about
[semver](https://docs.npmjs.com/cli/v6/using-npm/semver/) for more
information.

-   Move all binary executable packages to the `@esbuild/` scope

Binary package executables for esbuild are published as individual
packages separate from the main `esbuild` package so you only have to
download the relevant one for the current platform when you install
esbuild. This release moves all of these packages under the `@esbuild/`
scope to avoid collisions with 3rd-party packages. It also changes them
to a consistent naming scheme that uses the `os` and `cpu` names from
node.

    The package name changes are as follows:

    -   `@esbuild/linux-loong64` => `@esbuild/linux-loong64` (no change)
    -   `esbuild-android-64` => `@esbuild/android-x64`
    -   `esbuild-android-arm64` => `@esbuild/android-arm64`
    -   `esbuild-darwin-64` => `@esbuild/darwin-x64`
    -   `esbuild-darwin-arm64` => `@esbuild/darwin-arm64`
    -   `esbuild-freebsd-64` => `@esbuild/freebsd-x64`
    -   `esbuild-freebsd-arm64` => `@esbuild/freebsd-arm64`
    -   `esbuild-linux-32` => `@esbuild/linux-ia32`
    -   `esbuild-linux-64` => `@esbuild/linux-x64`
    -   `esbuild-linux-arm` => `@esbuild/linux-arm`
    -   `esbuild-linux-arm64` => `@esbuild/linux-arm64`
    -   `esbuild-linux-mips64le` => `@esbuild/linux-mips64el`
    -   `esbuild-linux-ppc64le` => `@esbuild/linux-ppc64`
    -   `esbuild-linux-riscv64` => `@esbuild/linux-riscv64`
    -   `esbuild-linux-s390x` => `@esbuild/linux-s390x`
    -   `esbuild-netbsd-64` => `@esbuild/netbsd-x64`
    -   `esbuild-openbsd-64` => `@esbuild/openbsd-x64`
    -   `esbuild-sunos-64` => `@esbuild/sunos-x64`
    -   `esbuild-wasm` => `esbuild-wasm` (no change)
    -   `esbuild-windows-32` => `@esbuild/win32-ia32`
    -   `esbuild-windows-64` => `@esbuild/win32-x64`
    -   `esbuild-windows-arm64` => `@esbuild/win32-arm64`
    -   `esbuild` => `esbuild` (no change)

Normal usage of the `esbuild` and `esbuild-wasm` packages should not be
affected. These name changes should only affect tools that hard-coded
the individual binary executable package names into custom esbuild
downloader scripts.

This change was not made with performance in mind. But as a bonus,
installing esbuild with npm may potentially happen faster now. This is
because npm's package installation protocol is inefficient: it always
downloads metadata for all past versions of each package even when it
only needs metadata about a single version. This makes npm package
downloads O(n) in the number of published versions, which penalizes
packages like esbuild that are updated regularly. Since most of
esbuild's package names have now changed, npm will now need to download
much less data when installing esbuild (8.72mb of package manifests
before this change → 0.06mb of package manifests after this change).
However, this is only a temporary improvement. Installing esbuild will
gradually get slower again as further versions of esbuild are published.

-   Publish a shell script that downloads esbuild directly

In addition to all of the existing ways to install esbuild, you can now
also download esbuild directly like this:

    ```sh
    curl -fsSL https://esbuild.github.io/dl/latest | sh
    ```

This runs a small shell script that downloads the latest `esbuild`
binary executable to the current directory. This can be convenient on
systems that don't have `npm` installed or when you just want to get a
copy of esbuild quickly without any extra steps. If you want a specific
version of esbuild (starting with this version onward), you can provide
that version in the URL instead of `latest`:

    ```sh
    curl -fsSL https://esbuild.github.io/dl/v0.16.0 | sh
    ```

Note that the download script needs to be able to access
registry.npmjs.org to be able to complete the download. This download
script doesn't yet support all of the platforms that esbuild supports
because I lack the necessary testing environments. If the download
script doesn't work for you because you're on an unsupported platform,
please file an issue on the esbuild repo so we can add support for it.

-   Fix some parameter names for the Go API

This release changes some parameter names for the Go API to be
consistent with the JavaScript and CLI APIs:

    -   `OutExtensions` => `OutExtension`
    -   `JSXMode` => `JSX`

-   Add additional validation of API parameters

The JavaScript API now does some additional validation of API parameters
to catch incorrect uses of esbuild's API. The biggest impact of this is
likely that esbuild now strictly only accepts strings with the `define`
parameter. This would already have been a type error with esbuild's
TypeScript type definitions, but it was previously not enforced for
people using esbuild's API JavaScript without TypeScript.

The `define` parameter appears at first glance to take a JSON object if
you aren't paying close attention, but this actually isn't true. Values
for `define` are instead strings of JavaScript code. This means you have
to use `define: { foo: '"bar"' }` to replace `foo` with the string
`"bar"`. Using `define: { foo: 'bar' }` actually replaces `foo` with the
identifier `bar`. Previously esbuild allowed you to pass `define: { foo:
false }` and `false` was automatically converted into a string, which
made it more confusing to understand what `define` actually represents.
Starting with this release, passing non-string values such as with
`define: { foo: false }` will no longer be allowed. You will now have to
write `define: { foo: 'false' }` instead.

- Generate shorter data URLs if possible
([#&#8203;1843](https://togithub.com/evanw/esbuild/issues/1843))

Loading a file with esbuild's `dataurl` loader generates a JavaScript
module with a [data
URL](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URLs)
for that file in a string as a single default export. Previously the
data URLs generated by esbuild all used [base64
encoding](https://en.wikipedia.org/wiki/Base64). However, this is
unnecessarily long for most textual data (e.g. SVG images). So with this
release, esbuild's `dataurl` loader will now use percent encoding
instead of base64 encoding if the result will be shorter. This can
result in ~25% smaller data URLs for large SVGs. If you want the old
behavior, you can use the `base64` loader instead and then construct the
data URL yourself.

- Avoid marking entry points as external
([#&#8203;2382](https://togithub.com/evanw/esbuild/issues/2382))

Previously you couldn't specify `--external:*` to mark all import paths
as external because that also ended up making the entry point itself
external, which caused the build to fail. With this release, esbuild's
`external` API parameter no longer applies to entry points so using
`--external:*` is now possible.

One additional consequence of this change is that the `kind` parameter
is now required when calling the `resolve()` function in esbuild's
plugin API. Previously the `kind` parameter defaulted to `entry-point`,
but that no longer interacts with `external` so it didn't seem wise for
this to continue to be the default. You now have to specify `kind` so
that the path resolution mode is explicit.

- Disallow non-`default` imports when `assert { type: 'json' }` is
present

There is now standard behavior for importing a JSON file into an ES
module using an `import` statement. However, it requires you to place
the `assert { type: 'json' }` import assertion after the import path.
This import assertion tells the JavaScript runtime to throw an error if
the import does not end up resolving to a JSON file. On the web, the
type of a file is determined by the `Content-Type` HTTP header instead
of by the file extension. The import assertion prevents security
problems on the web where a `.json` file may actually resolve to a
JavaScript file containing malicious code, which is likely not expected
for an import that is supposed to only contain pure side-effect free
data.

By default, esbuild uses the file extension to determine the type of a
file, so this import assertion is unnecessary with esbuild. However,
esbuild's JSON import feature has a non-standard extension that allows
you to import top-level properties of the JSON object as named imports.
For example, esbuild lets you do this:

    ```js
    import { version } from './package.json'
    ```

This is useful for tree-shaking when bundling because it means esbuild
will only include the the `version` field of `package.json` in your
bundle. This is non-standard behavior though and doesn't match the
behavior of what happens when you import JSON in a real JavaScript
runtime (after adding `assert { type: 'json' }`). In a real JavaScript
runtime the only thing you can import is the `default` import. So with
this release, esbuild will now prevent you from importing non-`default`
import names if `assert { type: 'json' }` is present. This ensures that
code containing `assert { type: 'json' }` isn't relying on non-standard
behavior that won't work everywhere. So the following code is now an
error with esbuild when bundling:

    ```js
    import { version } from './package.json' assert { type: 'json' }
    ```

In addition, adding `assert { type: 'json' }` to an import statement now
means esbuild will generate an error if the loader for the file is
anything other than `json`, which is required by the import assertion
specification.

- Provide a way to disable automatic escaping of `</script>`
([#&#8203;2649](https://togithub.com/evanw/esbuild/issues/2649))

If you inject esbuild's output into a script tag in an HTML file, code
containing the literal characters `</script>` will cause the tag to be
ended early which will break the code:

    ```html
    <script>
      console.log("</script>");
    </script>
    ```

To avoid this, esbuild automatically escapes these strings in generated
JavaScript files (e.g. `"</script>"` becomes `"<\/script>"` instead).
This also applies to `</style>` in generated CSS files. Previously this
always happened and there wasn't a way to turn this off.

With this release, esbuild will now only do this if the `platform`
setting is set to `browser` (the default value). Setting `platform` to
`node` or `neutral` will disable this behavior. This behavior can also
now be disabled with `--supported:inline-script=false` (for JS) and
`--supported:inline-style=false` (for CSS).

- Throw an early error if decoded UTF-8 text isn't a `Uint8Array`
([#&#8203;2532](https://togithub.com/evanw/esbuild/issues/2532))

If you run esbuild's JavaScript API in a broken JavaScript environment
where `new TextEncoder().encode("") instanceof Uint8Array` is false,
then esbuild's API will fail with a confusing serialization error
message that makes it seem like esbuild has a bug even though the real
problem is that the JavaScript environment itself is broken. This can
happen when using the test framework called [Jest](https://jestjs.io/).
With this release, esbuild's API will now throw earlier when it detects
that the environment is unable to encode UTF-8 text correctly with an
error message that makes it more clear that this is not a problem with
esbuild.

-   Change the default "legal comment" behavior

The legal comments feature automatically gathers comments containing
`@license` or `@preserve` and puts the comments somewhere (either in the
generated code or in a separate file). People sometimes want this to
happen so that the their dependencies' software licenses are retained in
the generated output code. By default esbuild puts these comments at the
end of the file when bundling. However, people sometimes find this
confusing because these comments can be very generic and may not mention
which library they come from. So with this release, esbuild will now
discard legal comments by default. You now have to opt-in to preserving
them if you want this behavior.

- Enable the `module` condition by default
([#&#8203;2417](https://togithub.com/evanw/esbuild/issues/2417))

Package authors want to be able to use the new
[`exports`](https://nodejs.org/api/packages.html#conditional-exports)
field in `package.json` to provide tree-shakable ESM code for ESM-aware
bundlers while simultaneously providing fallback CommonJS code for other
cases.

Node's proposed way to do this involves using the `import` and `require`
export conditions so that you get the ESM code if you use an import
statement and the CommonJS code if you use a require call. However, this
has a major drawback: if some code in the bundle uses an import
statement and other code in the bundle uses a require call, then you'll
get two copies of the same package in the bundle. This is known as the
[dual package
hazard](https://nodejs.org/api/packages.html#dual-package-hazard) and
can lead to bloated bundles or even worse to subtle logic bugs.

Webpack supports an alternate solution: an export condition called
`module` that takes effect regardless of whether the package was
imported using an import statement or a require call. This works because
bundlers such as Webpack support importing a ESM using a require call
(something node doesn't support). You could already do this with esbuild
using `--conditions=module` but you previously had to explicitly enable
this. Package authors are concerned that esbuild users won't know to do
this and will get suboptimal output with their package, so they have
requested for esbuild to do this automatically.

So with this release, esbuild will now automatically add the `module`
condition when there aren't any custom `conditions` already configured.
You can disable this with `--conditions=` or `conditions: []` (i.e.
explicitly clearing all custom conditions).

-   Rename the `master` branch to `main`

The primary branch for this repository was previously called `master`
but is now called `main`. This change mirrors a similar change in many
other projects.

- Remove esbuild's `_exit(0)` hack for WebAssembly
([#&#8203;714](https://togithub.com/evanw/esbuild/issues/714))

Node had an unfortunate bug where the node process is unnecessarily kept
open while a WebAssembly module is being optimized:
[https://github.com/nodejs/node/issues/36616](https://togithub.com/nodejs/node/issues/36616).
This means cases where running `esbuild` should take a few milliseconds
can end up taking many seconds instead.

The workaround was to force node to exit by ending the process early.
This was done by esbuild in one of two ways depending on the exit code.
For non-zero exit codes (i.e. when there is a build error), the
`esbuild` command could just call `process.kill(process.pid)` to avoid
the hang. But for zero exit codes, esbuild had to load a N-API native
node extension that calls the operating system's `exit(0)` function.

However, this problem has essentially been fixed in node starting with
version 18.3.0. So I have removed this hack from esbuild. If you are
using an earlier version of node with `esbuild-wasm` and you don't want
the `esbuild` command to hang for a while when exiting, you can upgrade
to node 18.3.0 or higher to remove the hang.

The fix came from a V8 upgrade: [this
commit](https://togithub.com/v8/v8/commit/bfe12807c14c91714c7db1485e6b265439375e16)
enabled [dynamic tiering for
WebAssembly](https://v8.dev/blog/wasm-dynamic-tiering) by default for
all projects that use V8's WebAssembly implementation. Previously all
functions in the WebAssembly module were optimized in a single batch job
but with dynamic tiering, V8 now optimizes individual WebAssembly
functions as needed. This avoids unnecessary WebAssembly compilation
which allows node to exit on time.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/BirthdayResearch/contented).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC40OS4wIiwidXBkYXRlZEluVmVyIjoiMzQuNTQuMiJ9-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@bnoordhuis
Copy link
Member

Re: #36616 (comment) - yes, I do believe this is fixed in v18.x and newer. v16.x is almost EOL and won't get any big updates anymore so I'll go ahead and close this.

f0rmiga referenced this issue in aspect-build/talkie Aug 11, 2023
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/Masterminds/sprig/v3](https://togithub.com/Masterminds/sprig)
| require | patch | `v3.2.2` -> `v3.2.3` |
|
[github.com/bazelbuild/rules_go](https://togithub.com/bazelbuild/rules_go)
| require | minor | `v0.36.0` -> `v0.37.0` |
| [github.com/emicklei/proto](https://togithub.com/emicklei/proto) |
require | patch | `v1.11.0` -> `v1.11.1` |
| [github.com/evanw/esbuild](https://togithub.com/evanw/esbuild) |
require | minor | `v0.15.16` -> `v0.16.3` |
|
[github.com/hashicorp/go-hclog](https://togithub.com/hashicorp/go-hclog)
| require | minor | `v1.3.1` -> `v1.4.0` |
|
[github.com/hashicorp/go-plugin](https://togithub.com/hashicorp/go-plugin)
| require | patch | `v1.4.6` -> `v1.4.8` |
| [golang.org/x/exp](https://togithub.com/golang/exp) | require | digest
| `6ab00d0` -> `732eee0` |
|
[google.golang.org/genproto](https://togithub.com/googleapis/go-genproto)
| require | digest | `1645502` -> `23e4bf6` |
| [k8s.io/apimachinery](https://togithub.com/kubernetes/apimachinery) |
require | patch | `v0.25.4` -> `v0.25.5` |

---

### ⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the
Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>Masterminds/sprig</summary>

###
[`v3.2.3`](https://togithub.com/Masterminds/sprig/releases/tag/v3.2.3)

[Compare
Source](https://togithub.com/Masterminds/sprig/compare/v3.2.2...v3.2.3)

#### Changed

- Updated docs (thanks [@&#8203;book987](https://togithub.com/book987)
[@&#8203;aJetHorn](https://togithub.com/aJetHorn)
[@&#8203;neelayu](https://togithub.com/neelayu)
[@&#8203;pellizzetti](https://togithub.com/pellizzetti)
[@&#8203;apricote](https://togithub.com/apricote)
[@&#8203;SaigyoujiYuyuko233](https://togithub.com/SaigyoujiYuyuko233)
[@&#8203;AlekSi](https://togithub.com/AlekSi))
- [#&#8203;348](https://togithub.com/Masterminds/sprig/issues/348):
Updated huandu/xstrings which fixed a snake case bug (thanks
[@&#8203;yxxhero](https://togithub.com/yxxhero))
- [#&#8203;353](https://togithub.com/Masterminds/sprig/issues/353):
Updated masterminds/semver which included bug fixes
- [#&#8203;354](https://togithub.com/Masterminds/sprig/issues/354):
Updated golang.org/x/crypto which included bug fixes

</details>

<details>
<summary>bazelbuild/rules_go</summary>

###
[`v0.37.0`](https://togithub.com/bazelbuild/rules_go/releases/tag/v0.37.0)

[Compare
Source](https://togithub.com/bazelbuild/rules_go/compare/v0.36.0...v0.37.0)

#### Major New Features

- Support fetching packages for generated code in the Go Packages Driver

#### What's Changed

- bzlmod: Add missing `strip_prefix` field to `source.template.json` by
[@&#8203;fmeum](https://togithub.com/fmeum) in
[https://github.com/bazelbuild/rules_go/pull/3359](https://togithub.com/bazelbuild/rules_go/pull/3359)
- Declare toolchains in a separate repository by
[@&#8203;jfirebaugh](https://togithub.com/jfirebaugh) in
[https://github.com/bazelbuild/rules_go/pull/3348](https://togithub.com/bazelbuild/rules_go/pull/3348)
- Delete legacy actions API by
[@&#8203;fmeum](https://togithub.com/fmeum) in
[https://github.com/bazelbuild/rules_go/pull/3173](https://togithub.com/bazelbuild/rules_go/pull/3173)
- go_path: support go:embed of generated files by
[@&#8203;S-Chan](https://togithub.com/S-Chan) in
[https://github.com/bazelbuild/rules_go/pull/3285](https://togithub.com/bazelbuild/rules_go/pull/3285)
- Properly deprecate `bindata`, `go_embed_data`, and
`go_embed_data_deps` by [@&#8203;fmeum](https://togithub.com/fmeum) in
[https://github.com/bazelbuild/rules_go/pull/3362](https://togithub.com/bazelbuild/rules_go/pull/3362)
- link.bzl: ignore duplicate dep on coverdata by
[@&#8203;robfig](https://togithub.com/robfig) in
[https://github.com/bazelbuild/rules_go/pull/3032](https://togithub.com/bazelbuild/rules_go/pull/3032)
- feat(pkg-drv): add support for generated files by
[@&#8203;JamyDev](https://togithub.com/JamyDev) in
[https://github.com/bazelbuild/rules_go/pull/3354](https://togithub.com/bazelbuild/rules_go/pull/3354)
- Remove unused variables in link action by
[@&#8203;fmeum](https://togithub.com/fmeum) in
[https://github.com/bazelbuild/rules_go/pull/3367](https://togithub.com/bazelbuild/rules_go/pull/3367)
- Reduce number of declared files in `emit_stdlib` by
[@&#8203;fmeum](https://togithub.com/fmeum) in
[https://github.com/bazelbuild/rules_go/pull/3366](https://togithub.com/bazelbuild/rules_go/pull/3366)
- Update docs regarding vendored proto files by
[@&#8203;garymm](https://togithub.com/garymm) in
[https://github.com/bazelbuild/rules_go/pull/3360](https://togithub.com/bazelbuild/rules_go/pull/3360)
- go link: use external linker when in race mode by
[@&#8203;motiejus](https://togithub.com/motiejus) in
[https://github.com/bazelbuild/rules_go/pull/3370](https://togithub.com/bazelbuild/rules_go/pull/3370)
- Adding first example by
[@&#8203;chrislovecnm](https://togithub.com/chrislovecnm) in
[https://github.com/bazelbuild/rules_go/pull/3317](https://togithub.com/bazelbuild/rules_go/pull/3317)
- fix(packagesdriver): bazelFlags should prefix the command by
[@&#8203;JamyDev](https://togithub.com/JamyDev) in
[https://github.com/bazelbuild/rules_go/pull/3371](https://togithub.com/bazelbuild/rules_go/pull/3371)
- chore(gpd): export aspect utils for reusability by
[@&#8203;JamyDev](https://togithub.com/JamyDev) in
[https://github.com/bazelbuild/rules_go/pull/3373](https://togithub.com/bazelbuild/rules_go/pull/3373)
- nogo: Add a \_base key to be a default config for all Analyzers. by
[@&#8203;DolceTriade](https://togithub.com/DolceTriade) in
[https://github.com/bazelbuild/rules_go/pull/3351](https://togithub.com/bazelbuild/rules_go/pull/3351)
- Document that `Rlocation` can return relative paths by
[@&#8203;fmeum](https://togithub.com/fmeum) in
[https://github.com/bazelbuild/rules_go/pull/3377](https://togithub.com/bazelbuild/rules_go/pull/3377)
- Fix normalization check for `Rlocation` path by
[@&#8203;fmeum](https://togithub.com/fmeum) in
[https://github.com/bazelbuild/rules_go/pull/3378](https://togithub.com/bazelbuild/rules_go/pull/3378)
- fix(gpd): Write large target patterns to file by
[@&#8203;JamyDev](https://togithub.com/JamyDev) in
[https://github.com/bazelbuild/rules_go/pull/3372](https://togithub.com/bazelbuild/rules_go/pull/3372)
- Make Go runfiles library repo mapping aware by
[@&#8203;fmeum](https://togithub.com/fmeum) in
[https://github.com/bazelbuild/rules_go/pull/3347](https://togithub.com/bazelbuild/rules_go/pull/3347)

#### New Contributors

- [@&#8203;jfirebaugh](https://togithub.com/jfirebaugh) made their first
contribution in
[https://github.com/bazelbuild/rules_go/pull/3348](https://togithub.com/bazelbuild/rules_go/pull/3348)
- [@&#8203;S-Chan](https://togithub.com/S-Chan) made their first
contribution in
[https://github.com/bazelbuild/rules_go/pull/3285](https://togithub.com/bazelbuild/rules_go/pull/3285)
- [@&#8203;garymm](https://togithub.com/garymm) made their first
contribution in
[https://github.com/bazelbuild/rules_go/pull/3360](https://togithub.com/bazelbuild/rules_go/pull/3360)
- [@&#8203;motiejus](https://togithub.com/motiejus) made their first
contribution in
[https://github.com/bazelbuild/rules_go/pull/3370](https://togithub.com/bazelbuild/rules_go/pull/3370)
- [@&#8203;chrislovecnm](https://togithub.com/chrislovecnm) made their
first contribution in
[https://github.com/bazelbuild/rules_go/pull/3317](https://togithub.com/bazelbuild/rules_go/pull/3317)
- [@&#8203;DolceTriade](https://togithub.com/DolceTriade) made their
first contribution in
[https://github.com/bazelbuild/rules_go/pull/3351](https://togithub.com/bazelbuild/rules_go/pull/3351)

**Full Changelog**:
bazel-contrib/rules_go@v0.36.0...v0.37.0

#### `WORKSPACE` code

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl",
"http_archive")

    http_archive(
        name = "io_bazel_rules_go",
sha256 =
"56d8c5a5c91e1af73eca71a6fab2ced959b67c86d12ba37feedb0a2dfea441a6",
        urls = [

"https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.37.0/rules_go-v0.37.0.zip",

"https://github.com/bazelbuild/rules_go/releases/download/v0.37.0/rules_go-v0.37.0.zip",
        ],
    )

load("@&#8203;io_bazel_rules_go//go:deps.bzl", "go_register_toolchains",
"go_rules_dependencies")

    go_rules_dependencies()

    go_register_toolchains(version = "1.19.3")

</details>

<details>
<summary>emicklei/proto</summary>

###
[`v1.11.1`](https://togithub.com/emicklei/proto/blob/HEAD/CHANGES.md#v1111-2022-12-01)

[Compare
Source](https://togithub.com/emicklei/proto/compare/v1.11.0...v1.11.1)

-   added Doc for MapField so it implements Documented

</details>

<details>
<summary>evanw/esbuild</summary>

### [`v0.16.3`](https://togithub.com/evanw/esbuild/releases/tag/v0.16.3)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.2...v0.16.3)

- Fix a hang with the JS API in certain cases
([#&#8203;2727](https://togithub.com/evanw/esbuild/issues/2727))

A change that was made in version 0.15.13 accidentally introduced a case
when using esbuild's JS API could cause the node process to fail to
exit. The change broke esbuild's watchdog timer, which detects if the
parent process no longer exists and then automatically exits esbuild.
This hang happened when you ran node as a child process with the
`stderr` stream set to `pipe` instead of `inherit`, in the child process
you call esbuild's JS API and pass `incremental: true` but do not call
`dispose()` on the returned `rebuild` object, and then call
`process.exit()`. In that case the parent node process was still waiting
for the esbuild process that was created by the child node process to
exit. The change made in version 0.15.13 was trying to avoid using Go's
`sync.WaitGroup` API incorrectly because the API is not thread-safe.
Instead of doing this, I have now reverted that change and implemented a
thread-safe version of the `sync.WaitGroup` API for esbuild to use
instead.

### [`v0.16.2`](https://togithub.com/evanw/esbuild/releases/tag/v0.16.2)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.1...v0.16.2)

- Fix `process.env.NODE_ENV` substitution when transforming
([#&#8203;2718](https://togithub.com/evanw/esbuild/issues/2718))

Version 0.16.0 introduced an unintentional regression that caused
`process.env.NODE_ENV` to be automatically substituted with either
`"development"` or `"production"` when using esbuild's `transform` API.
This substitution is a necessary feature of esbuild's `build` API
because the React framework crashes when you bundle it without doing
this. But the `transform` API is typically used as part of a larger
build pipeline so the benefit of esbuild doing this automatically is not
as clear, and esbuild previously didn't do this.

However, version 0.16.0 switched the default value of the `platform`
setting for the `transform` API from `neutral` to `browser`, both to
align it with esbuild's documentation (which says `browser` is the
default value) and because escaping the `</script>` character sequence
is now tied to the `browser` platform (see the release notes for version
0.16.0 for details). That accidentally enabled automatic substitution of
`process.env.NODE_ENV` because esbuild always did that for code meant
for the browser. To fix this regression, esbuild will now only
automatically substitute `process.env.NODE_ENV` when using the `build`
API.

- Prevent `define` from substituting constants into assignment position
([#&#8203;2719](https://togithub.com/evanw/esbuild/issues/2719))

The `define` feature lets you replace certain expressions with
constants. For example, you could use it to replace references to the
global property reference `window.DEBUG` with `false` at compile time,
which can then potentially help esbuild remove unused code from your
bundle. It's similar to
[DefinePlugin](https://webpack.js.org/plugins/define-plugin/) in
Webpack.

However, if you write code such as `window.DEBUG = true` and then
defined `window.DEBUG` to `false`, esbuild previously generated the
output `false = true` which is a syntax error in JavaScript. This
behavior is not typically a problem because it doesn't make sense to
substitute `window.DEBUG` with a constant if its value changes at
run-time (Webpack's `DefinePlugin` also generates `false = true` in this
case). But it can be alarming to have esbuild generate code with a
syntax error.

So with this release, esbuild will no longer substitute `define`
constants into assignment position to avoid generating code with a
syntax error. Instead esbuild will generate a warning, which currently
looks like this:

▲ [WARNING] Suspicious assignment to defined constant "window.DEBUG"
[assign-to-define]

            example.js:1:0:
              1 │ window.DEBUG = true
                ╵ ~~~~~~~~~~~~

The expression "window.DEBUG" has been configured to be replaced with a
constant using the
"define" feature. If this expression is supposed to be a compile-time
constant, then it doesn't
make sense to assign to it here. Or if this expression is supposed to
change at run-time, this
          "define" substitution should be removed.

- Fix a regression with `npm install --no-optional`
([#&#8203;2720](https://togithub.com/evanw/esbuild/issues/2720))

Normally when you install esbuild with `npm install`, npm itself is the
tool that downloads the correct binary executable for the current
platform. This happens because of how esbuild's primary package uses
npm's `optionalDependencies` feature. However, if you deliberately
disable this with `npm install --no-optional` then esbuild's install
script will attempt to repair the installation by manually downloading
and extracting the binary executable from the package that was supposed
to be installed.

The change in version 0.16.0 to move esbuild's nested packages into the
`@esbuild/` scope unintentionally broke this logic because of how npm's
URL structure is different for scoped packages vs. normal packages. It
was actually already broken for a few platforms earlier because esbuild
already had packages for some platforms in the `@esbuild/` scope, but I
didn't discover this then because esbuild's integration tests aren't run
on all platforms. Anyway, this release contains some changes to the
install script that should hopefully get this scenario working again.

### [`v0.16.1`](https://togithub.com/evanw/esbuild/releases/tag/v0.16.1)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.16.0...v0.16.1)

This is a hotfix for the previous release.

- Re-allow importing JSON with the `copy` loader using an import
assertion

The previous release made it so when `assert { type: 'json' }` is
present on an import statement, esbuild validated that the `json` loader
was used. This is what an import assertion is supposed to do. However, I
forgot about the relatively new `copy` loader, which sort of behaves as
if the import path was marked as external (and thus not loaded at all)
except that the file is copied to the output directory and the import
path is rewritten to point to the copy. In this case whatever JavaScript
runtime ends up running the code is the one to evaluate the import
assertion. So esbuild should really allow this case as well. With this
release, esbuild now allows both the `json` and `copy` loaders when an
`assert { type: 'json' }` import assertion is present.

### [`v0.16.0`](https://togithub.com/evanw/esbuild/releases/tag/v0.16.0)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.18...v0.16.0)

**This release deliberately contains backwards-incompatible changes.**
To avoid automatically picking up releases like this, you should either
be pinning the exact version of `esbuild` in your `package.json` file
(recommended) or be using a version range syntax that only accepts patch
upgrades such as `^0.15.0` or `~0.15.0`. See npm's documentation about
[semver](https://docs.npmjs.com/cli/v6/using-npm/semver/) for more
information.

-   Move all binary executable packages to the `@esbuild/` scope

Binary package executables for esbuild are published as individual
packages separate from the main `esbuild` package so you only have to
download the relevant one for the current platform when you install
esbuild. This release moves all of these packages under the `@esbuild/`
scope to avoid collisions with 3rd-party packages. It also changes them
to a consistent naming scheme that uses the `os` and `cpu` names from
node.

    The package name changes are as follows:

    -   `@esbuild/linux-loong64` => `@esbuild/linux-loong64` (no change)
    -   `esbuild-android-64` => `@esbuild/android-x64`
    -   `esbuild-android-arm64` => `@esbuild/android-arm64`
    -   `esbuild-darwin-64` => `@esbuild/darwin-x64`
    -   `esbuild-darwin-arm64` => `@esbuild/darwin-arm64`
    -   `esbuild-freebsd-64` => `@esbuild/freebsd-x64`
    -   `esbuild-freebsd-arm64` => `@esbuild/freebsd-arm64`
    -   `esbuild-linux-32` => `@esbuild/linux-ia32`
    -   `esbuild-linux-64` => `@esbuild/linux-x64`
    -   `esbuild-linux-arm` => `@esbuild/linux-arm`
    -   `esbuild-linux-arm64` => `@esbuild/linux-arm64`
    -   `esbuild-linux-mips64le` => `@esbuild/linux-mips64el`
    -   `esbuild-linux-ppc64le` => `@esbuild/linux-ppc64`
    -   `esbuild-linux-riscv64` => `@esbuild/linux-riscv64`
    -   `esbuild-linux-s390x` => `@esbuild/linux-s390x`
    -   `esbuild-netbsd-64` => `@esbuild/netbsd-x64`
    -   `esbuild-openbsd-64` => `@esbuild/openbsd-x64`
    -   `esbuild-sunos-64` => `@esbuild/sunos-x64`
    -   `esbuild-wasm` => `esbuild-wasm` (no change)
    -   `esbuild-windows-32` => `@esbuild/win32-ia32`
    -   `esbuild-windows-64` => `@esbuild/win32-x64`
    -   `esbuild-windows-arm64` => `@esbuild/win32-arm64`
    -   `esbuild` => `esbuild` (no change)

Normal usage of the `esbuild` and `esbuild-wasm` packages should not be
affected. These name changes should only affect tools that hard-coded
the individual binary executable package names into custom esbuild
downloader scripts.

This change was not made with performance in mind. But as a bonus,
installing esbuild with npm may potentially happen faster now. This is
because npm's package installation protocol is inefficient: it always
downloads metadata for all past versions of each package even when it
only needs metadata about a single version. This makes npm package
downloads O(n) in the number of published versions, which penalizes
packages like esbuild that are updated regularly. Since most of
esbuild's package names have now changed, npm will now need to download
much less data when installing esbuild (8.72mb of package manifests
before this change → 0.06mb of package manifests after this change).
However, this is only a temporary improvement. Installing esbuild will
gradually get slower again as further versions of esbuild are published.

-   Publish a shell script that downloads esbuild directly

In addition to all of the existing ways to install esbuild, you can now
also download esbuild directly like this:

    ```sh
    curl -fsSL https://esbuild.github.io/dl/latest | sh
    ```

This runs a small shell script that downloads the latest `esbuild`
binary executable to the current directory. This can be convenient on
systems that don't have `npm` installed or when you just want to get a
copy of esbuild quickly without any extra steps. If you want a specific
version of esbuild (starting with this version onward), you can provide
that version in the URL instead of `latest`:

    ```sh
    curl -fsSL https://esbuild.github.io/dl/v0.16.0 | sh
    ```

Note that the download script needs to be able to access
registry.npmjs.org to be able to complete the download. This download
script doesn't yet support all of the platforms that esbuild supports
because I lack the necessary testing environments. If the download
script doesn't work for you because you're on an unsupported platform,
please file an issue on the esbuild repo so we can add support for it.

-   Fix some parameter names for the Go API

This release changes some parameter names for the Go API to be
consistent with the JavaScript and CLI APIs:

    -   `OutExtensions` => `OutExtension`
    -   `JSXMode` => `JSX`

-   Add additional validation of API parameters

The JavaScript API now does some additional validation of API parameters
to catch incorrect uses of esbuild's API. The biggest impact of this is
likely that esbuild now strictly only accepts strings with the `define`
parameter. This would already have been a type error with esbuild's
TypeScript type definitions, but it was previously not enforced for
people using esbuild's API JavaScript without TypeScript.

The `define` parameter appears at first glance to take a JSON object if
you aren't paying close attention, but this actually isn't true. Values
for `define` are instead strings of JavaScript code. This means you have
to use `define: { foo: '"bar"' }` to replace `foo` with the string
`"bar"`. Using `define: { foo: 'bar' }` actually replaces `foo` with the
identifier `bar`. Previously esbuild allowed you to pass `define: { foo:
false }` and `false` was automatically converted into a string, which
made it more confusing to understand what `define` actually represents.
Starting with this release, passing non-string values such as with
`define: { foo: false }` will no longer be allowed. You will now have to
write `define: { foo: 'false' }` instead.

- Generate shorter data URLs if possible
([#&#8203;1843](https://togithub.com/evanw/esbuild/issues/1843))

Loading a file with esbuild's `dataurl` loader generates a JavaScript
module with a [data
URL](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URLs)
for that file in a string as a single default export. Previously the
data URLs generated by esbuild all used [base64
encoding](https://en.wikipedia.org/wiki/Base64). However, this is
unnecessarily long for most textual data (e.g. SVG images). So with this
release, esbuild's `dataurl` loader will now use percent encoding
instead of base64 encoding if the result will be shorter. This can
result in ~25% smaller data URLs for large SVGs. If you want the old
behavior, you can use the `base64` loader instead and then construct the
data URL yourself.

- Avoid marking entry points as external
([#&#8203;2382](https://togithub.com/evanw/esbuild/issues/2382))

Previously you couldn't specify `--external:*` to mark all import paths
as external because that also ended up making the entry point itself
external, which caused the build to fail. With this release, esbuild's
`external` API parameter no longer applies to entry points so using
`--external:*` is now possible.

One additional consequence of this change is that the `kind` parameter
is now required when calling the `resolve()` function in esbuild's
plugin API. Previously the `kind` parameter defaulted to `entry-point`,
but that no longer interacts with `external` so it didn't seem wise for
this to continue to be the default. You now have to specify `kind` so
that the path resolution mode is explicit.

- Disallow non-`default` imports when `assert { type: 'json' }` is
present

There is now standard behavior for importing a JSON file into an ES
module using an `import` statement. However, it requires you to place
the `assert { type: 'json' }` import assertion after the import path.
This import assertion tells the JavaScript runtime to throw an error if
the import does not end up resolving to a JSON file. On the web, the
type of a file is determined by the `Content-Type` HTTP header instead
of by the file extension. The import assertion prevents security
problems on the web where a `.json` file may actually resolve to a
JavaScript file containing malicious code, which is likely not expected
for an import that is supposed to only contain pure side-effect free
data.

By default, esbuild uses the file extension to determine the type of a
file, so this import assertion is unnecessary with esbuild. However,
esbuild's JSON import feature has a non-standard extension that allows
you to import top-level properties of the JSON object as named imports.
For example, esbuild lets you do this:

    ```js
    import { version } from './package.json'
    ```

This is useful for tree-shaking when bundling because it means esbuild
will only include the the `version` field of `package.json` in your
bundle. This is non-standard behavior though and doesn't match the
behavior of what happens when you import JSON in a real JavaScript
runtime (after adding `assert { type: 'json' }`). In a real JavaScript
runtime the only thing you can import is the `default` import. So with
this release, esbuild will now prevent you from importing non-`default`
import names if `assert { type: 'json' }` is present. This ensures that
code containing `assert { type: 'json' }` isn't relying on non-standard
behavior that won't work everywhere. So the following code is now an
error with esbuild when bundling:

    ```js
    import { version } from './package.json' assert { type: 'json' }
    ```

In addition, adding `assert { type: 'json' }` to an import statement now
means esbuild will generate an error if the loader for the file is
anything other than `json`, which is required by the import assertion
specification.

- Provide a way to disable automatic escaping of `</script>`
([#&#8203;2649](https://togithub.com/evanw/esbuild/issues/2649))

If you inject esbuild's output into a script tag in an HTML file, code
containing the literal characters `</script>` will cause the tag to be
ended early which will break the code:

    ```html
    <script>
      console.log("</script>");
    </script>
    ```

To avoid this, esbuild automatically escapes these strings in generated
JavaScript files (e.g. `"</script>"` becomes `"<\/script>"` instead).
This also applies to `</style>` in generated CSS files. Previously this
always happened and there wasn't a way to turn this off.

With this release, esbuild will now only do this if the `platform`
setting is set to `browser` (the default value). Setting `platform` to
`node` or `neutral` will disable this behavior. This behavior can also
now be disabled with `--supported:inline-script=false` (for JS) and
`--supported:inline-style=false` (for CSS).

- Throw an early error if decoded UTF-8 text isn't a `Uint8Array`
([#&#8203;2532](https://togithub.com/evanw/esbuild/issues/2532))

If you run esbuild's JavaScript API in a broken JavaScript environment
where `new TextEncoder().encode("") instanceof Uint8Array` is false,
then esbuild's API will fail with a confusing serialization error
message that makes it seem like esbuild has a bug even though the real
problem is that the JavaScript environment itself is broken. This can
happen when using the test framework called [Jest](https://jestjs.io/).
With this release, esbuild's API will now throw earlier when it detects
that the environment is unable to encode UTF-8 text correctly with an
error message that makes it more clear that this is not a problem with
esbuild.

-   Change the default "legal comment" behavior

The legal comments feature automatically gathers comments containing
`@license` or `@preserve` and puts the comments somewhere (either in the
generated code or in a separate file). People sometimes want this to
happen so that the their dependencies' software licenses are retained in
the generated output code. By default esbuild puts these comments at the
end of the file when bundling. However, people sometimes find this
confusing because these comments can be very generic and may not mention
which library they come from. So with this release, esbuild will now
discard legal comments by default. You now have to opt-in to preserving
them if you want this behavior.

- Enable the `module` condition by default
([#&#8203;2417](https://togithub.com/evanw/esbuild/issues/2417))

Package authors want to be able to use the new
[`exports`](https://nodejs.org/api/packages.html#conditional-exports)
field in `package.json` to provide tree-shakable ESM code for ESM-aware
bundlers while simultaneously providing fallback CommonJS code for other
cases.

Node's proposed way to do this involves using the `import` and `require`
export conditions so that you get the ESM code if you use an import
statement and the CommonJS code if you use a require call. However, this
has a major drawback: if some code in the bundle uses an import
statement and other code in the bundle uses a require call, then you'll
get two copies of the same package in the bundle. This is known as the
[dual package
hazard](https://nodejs.org/api/packages.html#dual-package-hazard) and
can lead to bloated bundles or even worse to subtle logic bugs.

Webpack supports an alternate solution: an export condition called
`module` that takes effect regardless of whether the package was
imported using an import statement or a require call. This works because
bundlers such as Webpack support importing a ESM using a require call
(something node doesn't support). You could already do this with esbuild
using `--conditions=module` but you previously had to explicitly enable
this. Package authors are concerned that esbuild users won't know to do
this and will get suboptimal output with their package, so they have
requested for esbuild to do this automatically.

So with this release, esbuild will now automatically add the `module`
condition when there aren't any custom `conditions` already configured.
You can disable this with `--conditions=` or `conditions: []` (i.e.
explicitly clearing all custom conditions).

-   Rename the `master` branch to `main`

The primary branch for this repository was previously called `master`
but is now called `main`. This change mirrors a similar change in many
other projects.

- Remove esbuild's `_exit(0)` hack for WebAssembly
([#&#8203;714](https://togithub.com/evanw/esbuild/issues/714))

Node had an unfortunate bug where the node process is unnecessarily kept
open while a WebAssembly module is being optimized:
[https://github.com/nodejs/node/issues/36616](https://togithub.com/nodejs/node/issues/36616).
This means cases where running `esbuild` should take a few milliseconds
can end up taking many seconds instead.

The workaround was to force node to exit by ending the process early.
This was done by esbuild in one of two ways depending on the exit code.
For non-zero exit codes (i.e. when there is a build error), the
`esbuild` command could just call `process.kill(process.pid)` to avoid
the hang. But for zero exit codes, esbuild had to load a N-API native
node extension that calls the operating system's `exit(0)` function.

However, this problem has essentially been fixed in node starting with
version 18.3.0. So I have removed this hack from esbuild. If you are
using an earlier version of node with `esbuild-wasm` and you don't want
the `esbuild` command to hang for a while when exiting, you can upgrade
to node 18.3.0 or higher to remove the hang.

The fix came from a V8 upgrade: [this
commit](https://togithub.com/v8/v8/commit/bfe12807c14c91714c7db1485e6b265439375e16)
enabled [dynamic tiering for
WebAssembly](https://v8.dev/blog/wasm-dynamic-tiering) by default for
all projects that use V8's WebAssembly implementation. Previously all
functions in the WebAssembly module were optimized in a single batch job
but with dynamic tiering, V8 now optimizes individual WebAssembly
functions as needed. This avoids unnecessary WebAssembly compilation
which allows node to exit on time.

###
[`v0.15.18`](https://togithub.com/evanw/esbuild/releases/tag/v0.15.18)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.17...v0.15.18)

-   Performance improvements for both JS and CSS

This release brings noticeable performance improvements for JS parsing
and for CSS parsing and printing. Here's an example benchmark for using
esbuild to pretty-print a single large minified CSS file and JS file:

    | Test case      | Previous release | This release       |
    |----------------|------------------|--------------------|
    | 4.8mb CSS file | 19ms             | 11ms (1.7x faster) |
    | 5.8mb JS file  | 36ms             | 32ms (1.1x faster) |

    The performance improvements were very straightforward:

- Identifiers were being scanned using a generic character advancement
function instead of using custom inline code. Advancing past each
character involved UTF-8 decoding as well as updating multiple member
variables. This was sped up using loop that skips UTF-8 decoding
entirely and that only updates member variables once at the end. This is
faster because identifiers are plain ASCII in the vast majority of
cases, so Unicode decoding is almost always unnecessary.

- CSS identifiers and CSS strings were still being printed one character
at a time. Apparently I forgot to move this part of esbuild's CSS
infrastructure beyond the proof-of-concept stage. These were both very
obvious in the profiler, so I think maybe I have just never profiled
esbuild's CSS printing before?

- There was unnecessary work being done that was related to source maps
when source map output was disabled. I likely haven't observed this
before because esbuild's benchmarks always have source maps enabled.
This work is now disabled when it's not going to be used.

I definitely should have caught these performance issues earlier. Better
late than never I suppose.

###
[`v0.15.17`](https://togithub.com/evanw/esbuild/releases/tag/v0.15.17)

[Compare
Source](https://togithub.com/evanw/esbuild/compare/v0.15.16...v0.15.17)

- Search for missing source map code on the file system
([#&#8203;2711](https://togithub.com/evanw/esbuild/issues/2711))

[Source maps](https://sourcemaps.info/spec.html) are JSON files that map
from compiled code back to the original code. They provide the original
source code using two arrays: `sources` (required) and `sourcesContent`
(optional). When bundling is enabled, esbuild is able to bundle code
with source maps that was compiled by other tools (e.g. with Webpack)
and emit source maps that map all the way back to the original code
(e.g. before Webpack compiled it).

Previously if the input source maps omitted the optional
`sourcesContent` array, esbuild would use `null` for the source content
in the source map that it generates (since the source content isn't
available). However, sometimes the original source code is actually
still present on the file system. With this release, esbuild will now
try to find the original source code using the path in the `sources`
array and will use that instead of `null` if it was found.

- Fix parsing bug with TypeScript `infer` and `extends`
([#&#8203;2712](https://togithub.com/evanw/esbuild/issues/2712))

This release fixes a bug where esbuild incorrectly failed to parse valid
TypeScript code that nests `extends` inside `infer` inside `extends`,
such as in the example below:

    ```ts
    type A<T> = {};
    type B = {} extends infer T extends {} ? A<T> : never;
    ```

    TypeScript code that does this should now be parsed correctly.

- Use `WebAssembly.instantiateStreaming` if available
([#&#8203;1036](https://togithub.com/evanw/esbuild/pull/1036),
[#&#8203;1900](https://togithub.com/evanw/esbuild/pull/1900))

Currently the WebAssembly version of esbuild uses `fetch` to download
`esbuild.wasm` and then `WebAssembly.instantiate` to compile it. There
is a newer API called `WebAssembly.instantiateStreaming` that both
downloads and compiles at the same time, which can be a performance
improvement if both downloading and compiling are slow. With this
release, esbuild now attempts to use `WebAssembly.instantiateStreaming`
and falls back to the original approach if that fails.

The implementation for this builds on a PR by
[@&#8203;lbwa](https://togithub.com/lbwa).

- Preserve Webpack comments inside constructor calls
([#&#8203;2439](https://togithub.com/evanw/esbuild/issues/2439))

This improves the use of esbuild as a faster TypeScript-to-JavaScript
frontend for Webpack, which has special [magic
comments](https://webpack.js.org/api/module-methods/#magic-comments)
inside `new Worker()` expressions that affect Webpack's behavior.

</details>

<details>
<summary>hashicorp/go-hclog</summary>

###
[`v1.4.0`](https://togithub.com/hashicorp/go-hclog/releases/tag/v1.4.0):
Add GetLevel

[Compare
Source](https://togithub.com/hashicorp/go-hclog/compare/v1.3.1...v1.4.0)

What it says on the tin, add GetLevel to the Logger interface.

#### What's Changed

- Add GetLevel to Logger interface by
[@&#8203;evanphx](https://togithub.com/evanphx) in
[https://github.com/hashicorp/go-hclog/pull/120](https://togithub.com/hashicorp/go-hclog/pull/120)

**Full Changelog**:
hashicorp/go-hclog@v1.3.1...v1.4.0

</details>

<details>
<summary>hashicorp/go-plugin</summary>

###
[`v1.4.8`](https://togithub.com/hashicorp/go-plugin/blob/HEAD/CHANGELOG.md#v148)

[Compare
Source](https://togithub.com/hashicorp/go-plugin/compare/v1.4.7...v1.4.8)

BUG FIXES:

- Fix windows build:
\[[GH-227](https://togithub.com/hashicorp/go-plugin/pull/227)]

###
[`v1.4.7`](https://togithub.com/hashicorp/go-plugin/blob/HEAD/CHANGELOG.md#v147)

[Compare
Source](https://togithub.com/hashicorp/go-plugin/compare/v1.4.6...v1.4.7)

ENHANCEMENTS:

- More detailed error message on plugin start failure:
\[[GH-223](https://togithub.com/hashicorp/go-plugin/pull/223)]

</details>

<details>
<summary>kubernetes/apimachinery</summary>

###
[`v0.25.5`](https://togithub.com/kubernetes/apimachinery/compare/v0.25.4...v0.25.5)

[Compare
Source](https://togithub.com/kubernetes/apimachinery/compare/v0.25.4...v0.25.5)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/aspect-build/silo).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC40MC4yIiwidXBkYXRlZEluVmVyIjoiMzQuNTEuMCJ9-->

Signed-off-by: Thulio Ferraz Assis <[email protected]>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Thulio Ferraz Assis <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
v8 platform Issues and PRs related to Node's v8::Platform implementation. wasm Issues and PRs related to WebAssembly.
Projects
None yet
Development

No branches or pull requests