build(deps): update dependency esbuild to v0.15.9 #4050
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.15.8
->0.15.9
Release Notes
evanw/esbuild
v0.15.9
Compare Source
Fix an obscure npm package installation issue with
--omit=optional
(#2558)The previous release introduced a regression with
npm install esbuild --omit=optional
where the filenode_modules/.bin/esbuild
would no longer be present after installation. That could cause any package scripts which used theesbuild
command to no longer work. This release fixes the regression sonode_modules/.bin/esbuild
should now be present again after installation. This regression only affected people installing esbuild usingnpm
with either the--omit=optional
or--no-optional
flag, which is a somewhat unusual situation.More details:
The reason for this regression is due to some obscure npm implementation details. Since the Go compiler doesn't support trivial cross-compiling on certain Android platforms, esbuild's installer installs a WebAssembly shim on those platforms instead. In the previous release I attempted to simplify esbuild's WebAssembly shims to depend on the
esbuild-wasm
package instead of including another whole copy of the WebAssembly binary (to make publishing faster and to save on file system space after installation). However, both theesbuild
package and theesbuild-wasm
package provide a binary calledesbuild
and it turns out that addingesbuild-wasm
as a nested dependency of theesbuild
package (specificallyesbuild
optionally depends on@esbuild/android-arm
which depends onesbuild-wasm
) caused npm to be confused about whatnode_modules/.bin/esbuild
is supposed to be.It's pretty strange and unexpected that disabling the installation of optional dependencies altogether would suddenly cause an optional dependency's dependency to conflict with the top-level package. What happens under the hood is that if
--omit=optional
is present, npm attempts to uninstall theesbuild-wasm
nested dependency at the end ofnpm install
(even though theesbuild-wasm
package was never installed due to--omit=optional
). This uninstallation causesnode_modules/.bin/esbuild
to be deleted.After doing a full investigation, I discovered that npm's handling of the
.bin
directory is deliberately very brittle. When multiple packages in the dependency tree put something in.bin
with the same name, the end result is non-deterministic/random. What you get in.bin
might be from one package, from the other package, or might be missing entirely. The workaround suggested by npm is to just avoid having two packages that put something in.bin
with the same name. So this was fixed by making the@esbuild/android-arm
andesbuild-android-64
packages each include another whole copy of the WebAssembly binary, which works because these packages don't put anything in.bin
.Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.