[Snyk] Upgrade esbuild from 0.17.19 to 0.18.17

[Woodpile37]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade esbuild from 0.17.19 to 0.18.17.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 18 versions ahead of your current version.
• The recommended version was released a month ago, on 2023-07-26.

Release notes

Package name: esbuild

• 0.18.17 - 2023-07-26
  

  • Support An+B syntax and :nth-*() pseudo-classes in CSS

    This adds support for the :nth-child(), :nth-last-child(), :nth-of-type(), and :nth-last-of-type() pseudo-classes to esbuild, which has the following consequences:

    • The An+B syntax is now parsed, so parse errors are now reported
    • An+B values inside these pseudo-classes are now pretty-printed (e.g. a leading + will be stripped because it's not in the AST)
    • When minification is enabled, An+B values are reduced to equivalent but shorter forms (e.g. 2n+0 => 2n, 2n+1 => odd)
    • Local CSS names in an of clause are now detected (e.g. in :nth-child(2n of :local(.foo)) the name foo is now renamed)
    / Original code */
    .foo:nth-child(+2n+1 of :local(.bar)) {
    color: red;
    }

    /* Old output (with --loader=local-css) */
    .stdin_foo:nth-child(+2n + 1 of :local(.bar)) {
    color: red;
    }

    /* New output (with --loader=local-css) */
    .stdin_foo:nth-child(2n+1 of .stdin_bar) {
    color: red;
    }

  • Adjust CSS nesting parser for IE7 hacks (#3272)

    This fixes a regression with esbuild's treatment of IE7 hacks in CSS. CSS nesting allows selectors to be used where declarations are expected. There's an IE7 hack where prefixing a declaration with a * causes that declaration to only be applied in IE7 due to a bug in IE7's CSS parser. However, it's valid for nested CSS selectors to start with *. So esbuild was incorrectly parsing these declarations and anything following it up until the next { as a selector for a nested CSS rule. This release changes esbuild's parser to terminate the parsing of selectors for nested CSS rules when a ; is encountered to fix this edge case:

    / Original code /
    .item {
    width: 100%;
    height: 1px;
    }

    /* Old output /
    .item {
    width: 100%; height: 1px; {
    }
    }

    /* New output /
    .item {
    width: 100%;
    height: 1px;
    }

    Note that the syntax for CSS nesting is about to change again, so esbuild's CSS parser may still not be completely accurate with how browsers do and/or will interpret CSS nesting syntax. Expect additional updates to esbuild's CSS parser in the future to deal with upcoming CSS specification changes.

  • Adjust esbuild's warning about undefined imports for TypeScript import equals declarations (#3271)

    In JavaScript, accessing a missing property on an import namespace object is supposed to result in a value of undefined at run-time instead of an error at compile-time. This is something that esbuild warns you about by default because doing this can indicate a bug with your code. For example:

    // app.js
    import * as styles from './styles'
    console.log(styles.buton)

    // styles.js
    export let button = {}

    If you bundle app.js with esbuild you will get this:

    // app.ts
    import * as styles from './styles'
    import ButtonType = styles.Button

    // styles.ts
    export interface Button {}

• 0.18.16 - 2023-07-23
  

  • Fix a regression with whitespace inside :is() (#3265)

    The change to parse the contents of :is() in version 0.18.14 introduced a regression that incorrectly flagged the contents as a syntax error if the contents started with a whitespace token (for example div:is( .foo ) {}). This regression has been fixed.

• 0.18.15 - 2023-07-20
  

  • Add the --serve-fallback= option (#2904)

    The web server built into esbuild serves the latest in-memory results of the configured build. If the requested path doesn't match any in-memory build result, esbuild also provides the --servedir= option to tell esbuild to serve the requested path from that directory instead. And if the requested path doesn't match either of those things, esbuild will either automatically generate a directory listing (for directories) or return a 404 error.

    Starting with this release, that last step can now be replaced with telling esbuild to serve a specific HTML file using the --serve-fallback= option. This can be used to provide a "not found" page for missing URLs. It can also be used to implement a single-page app that mutates the current URL and therefore requires the single app entry point to be served when the page is loaded regardless of whatever the current URL is.

  • Use the tsconfig field in package.json during extends resolution (#3247)

    This release adds a feature from TypeScript 3.2 where if a tsconfig.json file specifies a package name in the extends field and that package's package.json file has a tsconfig field, the contents of that field are used in the search for the base tsconfig.json file.

  • Implement CSS nesting without :is() when possible (#1945)

    Previously esbuild would always produce a warning when transforming nested CSS for a browser that doesn't support the :is() pseudo-class. This was because the nesting transform needs to generate an :is() in some complex cases which means the transformed CSS would then not work in that browser. However, the CSS nesting transform can often be done without generating an :is(). So with this release, esbuild will no longer warn when targeting browsers that don't support :is() in the cases where an :is() isn't needed to represent the nested CSS.

    In addition, esbuild's nested CSS transform has been updated to avoid generating an :is() in cases where an :is() is preferable but there's a longer alternative that is also equivalent. This update means esbuild can now generate a combinatorial explosion of CSS for complex CSS nesting syntax when targeting browsers that don't support :is(). This combinatorial explosion is necessary to accurately represent the original semantics. For example:

    / Original code */
    .first,
    .second,
    .third {
    & > & {
    color: red;
    }
    }

    /* Old output (with --target=chrome80) */
    :is(.first, .second, .third) > :is(.first, .second, .third) {
    color: red;
    }

    /* New output (with --target=chrome80) */
    .first > .first,
    .first > .second,
    .first > .third,
    .second > .first,
    .second > .second,
    .second > .third,
    .third > .first,
    .third > .second,
    .third > .third {
    color: red;
    }

    This change means you can now use CSS nesting with esbuild when targeting an older browser that doesn't support :is(). You'll now only get a warning from esbuild if you use complex CSS nesting syntax that esbuild can't represent in that older browser without using :is(). There are two such cases:

    / Case 1 */
    a b {
    .foo & {
    color: red;
    }
    }

    /* Case 2 */
    a {
    > b& {
    color: red;
    }
    }

    These two cases still need to use :is(), both for different reasons, and cannot be used when targeting an older browser that doesn't support :is():

    / Case 1 */
    .foo :is(a b) {
    color: red;
    }

    /* Case 2 */
    a > a:is(b) {
    color: red;
    }

  • Automatically lower inset in CSS for older browsers

    With this release, esbuild will now automatically expand the inset property to the top, right, bottom, and left properties when esbuild's target is set to a browser that doesn't support inset:

    / Original code */
    .app {
    position: absolute;
    inset: 10px 20px;
    }

    /* Old output (with --target=chrome80) */
    .app {
    position: absolute;
    inset: 10px 20px;
    }

    /* New output (with --target=chrome80) */
    .app {
    position: absolute;
    top: 10px;
    right: 20px;
    bottom: 10px;
    left: 20px;
    }

  • Add support for the new @ starting-style CSS rule (#3249)

    This at rule allow authors to start CSS transitions on first style update. That is, you can now make the transition take effect when the display property changes from none to block.

    / Original code */
    @ starting-style {
    h1 {
    background-color: transparent;
    }
    }

    /* Output */
    @ starting-style{h1{background-color:transparent}}

    This was contributed by @ yisibl.

• 0.18.14 - 2023-07-18
  Read more
• 0.18.13 - 2023-07-15
  Read more
• 0.18.12 - 2023-07-13
  Read more
• 0.18.11 - 2023-07-01
  Read more
• 0.18.10 - 2023-06-26
  

  • Fix a tree-shaking bug that removed side effects (#3195)

    This fixes a regression in version 0.18.4 where combining --minify-syntax with --keep-names could cause expressions with side effects after a function declaration to be considered side-effect free for tree shaking purposes. The reason was because --keep-names generates an expression statement containing a call to a helper function after the function declaration with a special flag that makes the function call able to be tree shaken, and then --minify-syntax could potentially merge that expression statement with following expressions without clearing the flag. This release fixes the bug by clearing the flag when merging expression statements together.

  • Fix an incorrect warning about CSS nesting (#3197)

    A warning is currently generated when transforming nested CSS to a browser that doesn't support :is() because transformed nested CSS may need to use that feature to represent nesting. This was previously always triggered when an at-rule was encountered in a declaration context. Typically the only case you would encounter this is when using CSS nesting within a selector rule. However, there is a case where that's not true: when using a margin at-rule such as @ top-left within @ page. This release avoids incorrectly generating a warning in this case by checking that the at-rule is within a selector rule before generating a warning.

• 0.18.9 - 2023-06-26
  Read more
• 0.18.8 - 2023-06-25
  Read more
• 0.18.7 - 2023-06-24
• 0.18.6 - 2023-06-20
• 0.18.5 - 2023-06-20
• 0.18.4 - 2023-06-16
• 0.18.3 - 2023-06-15
• 0.18.2 - 2023-06-13
• 0.18.1 - 2023-06-12
• 0.18.0 - 2023-06-09
• 0.17.19 - 2023-05-13

from esbuild GitHub release notes

Commit messages

Package name: esbuild

• 1771c71 publish 0.18.17 to npm
• 63de9e5 css: support `An+B` and `:nth-*()` syntax
• 517fd5c fix #3272: account for IE7 hacks in nested CSS
• 78eefe1 css: add source map entries for generated js names
• 8abb666 fix typo correction for generated export names
• abf1dc2 fix typos for import errors as well as warnings
• af2bc58 fix #3271: bad `import-is-undefined` warning in ts
• 2292036 publish 0.18.16 to npm
• 64f97bd fix #3266: support `--analyze` with `--serve`
• d645903 fix #3265: allow whitespace inside of `:is()`
• d514ba7 css: all tests now include output and warnings
• daf6473 publish 0.18.15 to npm
• 629c921 fix #3247: use `tsconfig` in `package.json`
• 60004e7 tsconfig tests: use consistent case
• 10826b7 make whitespace match surrounding code
• 73b2b52 feat: support CSS @ starting-style rule (#3249)
• ffb5ad1 add `workflow_dispatch` to `ci`
• fb68cec update go 1.20.5 => 1.20.6
• c8f97d3 fix fix(graph): Extract gqlFetch into GraphService Zapper-fi/studio#2904: add `--serve-fallback=`
• afd73d1 css: only show each `:is` warning once
• 47d4f89 css: nesting transform now avoids `:is` (fix(goldfinch): Move app integration to studio Zapper-fi/studio#1945)
• 7fcbdb8 css: set `shouldLowerNesting` flag unconditionally
• 09d69e4 css: move nesting transform onto parser object
• bf3acc1 css: lower `inset` for older browsers

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[changeset-bot]

⚠️ No Changeset found

Latest commit: df59914

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR