Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: upgrade esbuild to 0.24.0 address various issues #669

Closed
wants to merge 1 commit into from

Conversation

aquajach
Copy link

Thanks for maintaining this project!

Read and understood the reason behind closing another PR . But I would still like to submit this one because:

  1. To address multiple vulnerability issues that from golang. Of course, we could override the version of esbuild in our own package.json to work around them, but user experience suffers, especially have impact to new users of tsx who also care about vulnerabilities.
  2. The esbuild release is no longer with breaking change label.
  3. To avoid a potential esbuild-wasm crash coming from a bug in memchr update go 1.22.5 => 1.23.0 evanw/esbuild#3902
  4. To reduce the warnings mentioned in the earlier PR.
  5. To fix class field decorators in TypeScript if useDefineForClassFields is false (decorators on uninitialized class fields are not working when useDefineForClassFields: false evanw/esbuild#3913)

To be honest, none of them alone solves a critical problem of tsx itself but I hope with all together makes the impact bigger.

We all understand it is a good practice to keep dependencies up to date to a certain level with cautiousness. Comparing to big version jumps, I think smaller incremental hips is less risky for long run, although brings a bit of more work to do from maintainers' point of view.

@privatenumber
Copy link
Owner

It's marked as a breaking change here:
https://github.com/evanw/esbuild/releases/tag/v0.24.0

Unless you can give me a real reason for upgrading than "good practice to stay up to date", I'll be closing these PRs as it creates unnecessary work for me and has no impact on users.

Closing as a duplicate of #664

Repository owner locked and limited conversation to collaborators Oct 23, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants