You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@echarts.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2025/02/12 14:03:39 UTC
[PR] chore(deps-dev): bump esbuild from 0.8.39 to 0.25.0 [echarts]
dependabot[bot] opened a new pull request, #20753:
URL: https://github.com/apache/echarts/pull/20753
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.8.39 to 0.25.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p>
<blockquote>
<h2>v0.25.0</h2>
<p><strong>This release deliberately contains backwards-incompatible changes.</strong> To avoid automatically picking up releases like this, you should either be pinning the exact version of <code>esbuild</code> in your <code>package.json</code> file (recommended) or be using a version range syntax that only accepts patch upgrades such as <code>^0.24.0</code> or <code>~0.24.0</code>. See npm's documentation about <a href="https://docs.npmjs.com/cli/v6/using-npm/semver/">semver</a> for more information.</p>
<ul>
<li>
<p>Restrict access to esbuild's development server (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-67mh-4wv8-2f99">GHSA-67mh-4wv8-2f99</a>)</p>
<p>This change addresses esbuild's first security vulnerability report. Previously esbuild set the <code>Access-Control-Allow-Origin</code> header to <code>*</code> to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in <a href="https://github.com/evanw/esbuild/security/advisories/GHSA-67mh-4wv8-2f99">the report</a>.</p>
<p>Starting with this release, <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS">CORS</a> will now be disabled, and requests will now be denied if the host does not match the one provided to <code>--serve=</code>. The default host is <code>0.0.0.0</code>, which refers to all of the IP addresses that represent the local machine (e.g. both <code>127.0.0.1</code> and <code>192.168.0.1</code>). If you want to customize anything about esbuild's development server, you can <a href="https://esbuild.github.io/api/#serve-proxy">put a proxy in front of esbuild</a> and modify the incoming and/or outgoing requests.</p>
<p>In addition, the <code>serve()</code> API call has been changed to return an array of <code>hosts</code> instead of a single <code>host</code> string. This makes it possible to determine all of the hosts that esbuild's development server will accept.</p>
<p>Thanks to <a href="https://github.com/sapphi-red"><code>@sapphi-red</code></a> for reporting this issue.</p>
</li>
<li>
<p>Delete output files when a build fails in watch mode (<a href="https://redirect.github.com/evanw/esbuild/issues/3643">#3643</a>)</p>
<p>It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.</p>
</li>
<li>
<p>Fix correctness issues with the CSS nesting transform (<a href="https://redirect.github.com/evanw/esbuild/issues/3620">#3620</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/3877">#3877</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/3933">#3933</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/3997">#3997</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/4005">#4005</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4037">#4037</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4038">#4038</a>)</p>
<p>This release fixes the following problems:</p>
<ul>
<li>
<p>Naive expansion of CSS nesting can result in an exponential blow-up of generated CSS if each nesting level has multiple selectors. Previously esbuild sometimes collapsed individual nesting levels using <code>:is()</code> to limit expansion. However, this collapsing wasn't correct in some cases, so it has been removed to fix correctness issues.</p>
<pre lang="css"><code>/* Original code */
.parent {
> .a,
> .b1 > .b2 {
color: red;
}
}
<p>/* Old output (with --supported:nesting=false) */<br />
.parent > :is(.a, .b1 > .b2) {<br />
color: red;<br />
}</p>
<p>/* New output (with --supported:nesting=false) */<br />
.parent > .a,<br />
.parent > .b1 > .b2 {<br />
color: red;<br />
}<br />
</code></pre></p>
<p>Thanks to <a href="https://github.com/tim-we"><code>@tim-we</code></a> for working on a fix.</p>
</li>
<li>
<p>The <code>&</code> CSS nesting selector can be repeated multiple times to increase CSS specificity. Previously esbuild ignored this possibility and incorrectly considered <code>&&</code> to have the same specificity as <code>&</code>. With this release, this should now work correctly:</p>
<pre lang="css"><code>/* Original code (color should be red) */
</code></pre>
</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG-2021.md">esbuild's changelog</a>.</em></p>
<blockquote>
<h1>Changelog: 2021</h1>
<p>This changelog documents all esbuild versions published in the year 2021 (versions 0.8.29 through 0.14.10).</p>
<h2>0.14.10</h2>
<ul>
<li>
<p>Enable tree shaking of classes with lowered static fields (<a href="https://redirect.github.com/evanw/esbuild/issues/175">#175</a>)</p>
<p>If the configured target environment doesn't support static class fields, they are converted into a call to esbuild's <code>__publicField</code> function instead. However, esbuild's tree-shaking pass treated this call as a side effect, which meant that all classes with static fields were ineligible for tree shaking. This release fixes the problem by explicitly ignoring calls to the <code>__publicField</code> function during tree shaking side-effect determination. Tree shaking is now enabled for these classes:</p>
<pre lang="js"><code>// Original code
class Foo { static foo = 'foo' }
class Bar { static bar = 'bar' }
new Bar()
<p>// Old output (with --tree-shaking=true --target=es6)<br />
class Foo {<br />
}<br />
__publicField(Foo, "foo", "foo");<br />
class Bar {<br />
}<br />
__publicField(Bar, "bar", "bar");<br />
new Bar();</p>
<p>// New output (with --tree-shaking=true --target=es6)<br />
class Bar {<br />
}<br />
__publicField(Bar, "bar", "bar");<br />
new Bar();<br />
</code></pre></p>
</li>
<li>
<p>Treat <code>--define:foo=undefined</code> as an undefined literal instead of an identifier (<a href="https://redirect.github.com/evanw/esbuild/issues/1407">#1407</a>)</p>
<p>References to the global variable <code>undefined</code> are automatically replaced with the literal value for undefined, which appears as <code>void 0</code> when printed. This allows for additional optimizations such as collapsing <code>undefined ?? bar</code> into just <code>bar</code>. However, this substitution was not done for values specified via <code>--define:</code>. As a result, esbuild could potentially miss out on certain optimizations in these cases. With this release, it's now possible to use <code>--define:</code> to substitute something with an undefined literal:</p>
<pre lang="js"><code>// Original code
let win = typeof window !== 'undefined' ? window : {}
<p>// Old output (with --define:window=undefined --minify)<br />
let win=typeof undefined!="undefined"?undefined:{};</p>
<p>// New output (with --define:window=undefined --minify)<br />
let win={};<br />
</code></pre></p>
</li>
<li>
<p>Add the <code>--drop:debugger</code> flag (<a href="https://redirect.github.com/evanw/esbuild/issues/1809">#1809</a>)</p>
<p>Passing this flag causes all <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/debugger"><code>debugger;</code> statements</a> to be removed from the output. This is similar to the <code>drop_debugger: true</code> flag available in the popular UglifyJS and Terser JavaScript minifiers.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/evanw/esbuild/commit/e9174d671b1882758cd32ac5e146200f5bee3e45"><code>e9174d6</code></a> publish 0.25.0 to npm</li>
<li><a href="https://github.com/evanw/esbuild/commit/c27dbebb9e7a55dd9a084dd151dddd840787490e"><code>c27dbeb</code></a> fix <code>hosts</code> in <code>plugin-tests.js</code></li>
<li><a href="https://github.com/evanw/esbuild/commit/6794f602a453cf0255bcae245871de120a89a559"><code>6794f60</code></a> fix <code>hosts</code> in <code>node-unref-tests.js</code></li>
<li><a href="https://github.com/evanw/esbuild/commit/de85afd65edec9ebc44a11e245fd9e9a2e99760d"><code>de85afd</code></a> Merge commit from fork</li>
<li><a href="https://github.com/evanw/esbuild/commit/da1de1bf77a65f06654b49878d9ec4747ddaa21f"><code>da1de1b</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4065">#4065</a>: bitwise operators can return bigints</li>
<li><a href="https://github.com/evanw/esbuild/commit/f4e9d19fb20095a98bf40634f0380f6a16be91e7"><code>f4e9d19</code></a> switch case liveness: <code>default</code> is always last</li>
<li><a href="https://github.com/evanw/esbuild/commit/7aa47c3e778ea04849f97f18dd9959df88fa0886"><code>7aa47c3</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4028">#4028</a>: minify live/dead <code>switch</code> cases better</li>
<li><a href="https://github.com/evanw/esbuild/commit/22ecd306190b8971ec4474b5485266c20350e266"><code>22ecd30</code></a> minify: more constant folding for strict equality</li>
<li><a href="https://github.com/evanw/esbuild/commit/4cdf03c03697128044fa8fb76e5c478e9765b353"><code>4cdf03c</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4053">#4053</a>: reordering of <code>.tsx</code> in <code>node_modules</code></li>
<li><a href="https://github.com/evanw/esbuild/commit/dc719775b7140120916bd9e6777ca1cb8a1cdc0e"><code>dc71977</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/3692">#3692</a>: <code>0</code> now picks a random ephemeral port</li>
<li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.8.39...v0.25.0">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/echarts/network/alerts).
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For additional commands, e-mail: commits-help@echarts.apache.org
Re: [PR] chore(deps-dev): bump esbuild from 0.8.39 to 0.25.0 [echarts]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #20753:
URL: https://github.com/apache/echarts/pull/20753#issuecomment-2653821607
The changes brought by this PR can be previewed at: https://echarts.apache.org/examples/editor?version=PR-20753@0d3c0cf
<!-- ECHARTS_PR_PREVIEW -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For additional commands, e-mail: commits-help@echarts.apache.org
Re: [PR] chore(deps-dev): bump esbuild from 0.8.39 to 0.25.0 [echarts]
Posted by "plainheart (via GitHub)" <gi...@apache.org>.
plainheart closed pull request #20753: chore(deps-dev): bump esbuild from 0.8.39 to 0.25.0
URL: https://github.com/apache/echarts/pull/20753
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For additional commands, e-mail: commits-help@echarts.apache.org
Re: [PR] chore(deps-dev): bump esbuild from 0.8.39 to 0.25.0 [echarts]
Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.
dependabot[bot] commented on PR #20753:
URL: https://github.com/apache/echarts/pull/20753#issuecomment-2655363402
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting `@dependabot ignore this major version` or `@dependabot ignore this minor version`.
If you change your mind, just re-open this PR and I'll resolve any conflicts on it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For additional commands, e-mail: commits-help@echarts.apache.org
Re: [PR] chore(deps-dev): bump esbuild from 0.8.39 to 0.25.0 [echarts]
Posted by "echarts-bot[bot] (via GitHub)" <gi...@apache.org>.
echarts-bot[bot] commented on PR #20753:
URL: https://github.com/apache/echarts/pull/20753#issuecomment-2653804484
Thanks for your contribution!
The community will review it ASAP. In the meanwhile, please checkout [the coding standard](https://echarts.apache.org/en/coding-standard.html) and Wiki about [How to make a pull request](https://github.com/apache/echarts/wiki/How-to-make-a-pull-request).
To reviewers: If this PR is going to be described in the changelog in the future release, please make sure this PR has one of the following labels: `PR: doc ready`, `PR: awaiting doc`, `PR: doc unchanged`
This message is shown because the PR description doesn't contain the document related template.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For additional commands, e-mail: commits-help@echarts.apache.org