Repository navigation
Conversation
- `fast-uri` 3.1.8 -> 3.1.9 (via webpack's `ajv`): GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-333x-w4r6-6crp. - `qs` 6.16.0 -> 6.16.1 (via `http-server`): GHSA-6pq8-jhm2-2vcw.
The browser suite imports `index.mjs`, so nothing tested the bundles a `<script>` tag loads, and the next release rebuilds them with webpack 5. `npm run test-dist` loads each bundle in a fresh global scope and checks: the version banner, the `jsonpatch` global with the same exports as `index.js`, and one applied and one generated patch. It passes on the 3.1.1 bundles and on a fresh build, and fails on a banner left at an older version. - CI runs it after `test-browser`, which builds `dist/`. - The `version` script runs it before staging the release build.
esbuild replaces webpack for the `dist/` bundles and for the import test in the next commits. 0.28.2 is published from GitHub Actions with a provenance attestation. - Its only install script is a `postinstall` that swaps a JS shim for the native binary. `ignore-scripts=true` in `.npmrc` skips it, and esbuild still works without it. - The lockfile gets 26 optional `@esbuild/*` binaries, one per platform; npm installs only the one that matches.
`test-webpack-import` bundles `test/spec/webpack/importSpec.src.js` and runs the result, so the `import` path of the package stays covered. Do the same with esbuild, ahead of dropping webpack. - `test-bundler-import`: replaces `test-webpack-import` and is called by `npm test`. `--main-fields=module,main` makes esbuild resolve `index.mjs` like webpack did for `target: node`. - Move the spec to `test/spec/esbuild/` and say "esbuild" in its title. - Stop tracking the build output: `importSpec.build.js` is now ignored instead of committed.
Replace webpack in `npm run build`. The flags live in `package.json`, so there is no build config to maintain or to ship in the package. - `bundle`: `index.js` as an IIFE that defines the global `jsonpatch`, ES5 (`--target=es5`), with the `/*!` licence comments inline (`--legal-comments=inline`) and the `fast-json-patch, version: X` banner from `$npm_package_version`, so it needs a POSIX shell. - `build-dist`: the plain and the minified bundle. - Delete `webpack.config.js`. The package no longer ships it: 23 files instead of 24, none added. `npm run test-dist` passes on the new output: ES5 syntax, the same 15 exports, the banner and the three `/*!` comments. The bundles get smaller, as webpack's runtime is gone: 37.5 to 29.2 kB, minified 12.8 to 12.3 kB. `dist/` itself is not rebuilt here; the release build does that.
Nothing uses it any more. Remove `webpack`, `webpack-cli` and `minimizer-webpack-plugin` from the devDependencies. `package-lock.json` drops from 202 to 104 entries (175 before esbuild), 26 of them esbuild's per-platform binaries. `fast-uri` goes too: it was only there through webpack's `ajv`. - `tsconfig.json` and `test/spec/typings/tsconfig.json`: drop "from webpack" from the comment on `"types": []`. No `@types/*` package is installed any more; the setting stays, so the `@types` of a future devDependency don't leak into the build. - `bower.json`: drop `webpack.config.js` from `ignore`.
tomalec
force-pushed
the
build/esbuild
branch
from
October 27, 2026 21:58
4a5754b to
e4d2d67
Compare
Owner
Author
|
Moved upstream: Starcounter-Jack#336 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on
fix/npm-auditWhat
Bundles
dist/with esbuild instead of webpack, and drops webpack from the devDependencies.The browser bundles keep the same shape as 3.1.1:
--target=es5; esbuild refuses syntax it can't lower to ES5)jsonpatchglobal with the same 15 exports/*! fast-json-patch, version: … */banner and both licence headersThe bytes change, so the next release ships different bundles. On a fresh build:
dist/fast-json-patch.jsdist/fast-json-patch.min.jsdist/is not part of this PR. It is committed only by the release build (npm versionrunsbuild).Why
package-lock.jsongoes from 202 to 104 entries (175 before esbuild is added), 26 of them esbuild's per-platform binaries.fast-urigoes with it; it was only there through webpack'sajv.package.jsonscripts (build-dist,bundle) instead of a config file.webpack.config.jsis gone, so it is no longer in the published package (24 files → 23).Commits
test: smoke-test the browser bundles in dist/:npm run test-distloads each bundle in a fresh global scope and checks the banner, thejsonpatchglobal against the exports ofindex.js, and one applied and one generated patch. CI runs it aftertest-browser, which buildsdist/; theversionscript runs it before staging the release build.build: add esbuild as a devDependencytest: bundle the import test with esbuild: replacestest-webpack-importwithtest-bundler-import, same assertions.build: bundle dist/ with esbuildbuild: drop webpack: also removes the stalewebpack.config.jsentry frombower.jsonand the webpack mentions in thetsconfig.jsoncomments.Things to know
^0.28.2: published with provenance, well past the 7-daymin-release-agein.npmrc. Its install script is skipped byignore-scripts; the platform binaries come from optional dependencies.$npm_package_version, so buildingdist/needs a POSIX shell (Linux, macOS, Git Bash, WSL). The old config readpackage.jsonin Node.test-distchecks ES5 syntax through the build target, not runtime APIs (the bundle callsObject.assign, as the webpack one did).How to check
test-browseron Chromium, Firefox and WebKit)