evanw/esbuild

This system is esbuild, a high-performance JavaScript and CSS bundler and minifier. It provides a command-line interface, a Go API, and a WebAssembly-based API for browsers to bundle, transform, and minify code. The system handles module resolution, syntax lowering for older environments, and source map generation, while supporting modern features like CSS modules and Yarn Plug'n'Play.

36 changes.

The project underwent a major architectural rewrite, migrating the core bundler, parser, and printer from legacy Go implementations to a new internal package structure with dedicated CSS support. This period also established a new Go API and CLI infrastructure, replacing previous Node.js wrappers and legacy logging systems with a more robust, incremental build architecture.

10 changes.

This period focused on restructuring esbuild's internal architecture by introducing a dedicated graph package for linker data and refactoring the linker into a separate module to support incremental builds. Significant enhancements included adding Web Worker support for non-blocking browser builds, switching to xxHash for improved performance, and expanding npm package compatibility across diverse platforms and environments.

The resolver now implements the Yarn Plug'n'Play (PnP) specification, allowing projects using Yarn PnP to resolve dependencies correctly without a traditional node\_modules directory. This change introduces new internal files (yarnpnp.go, yarnpnp\_test.go) and test expectations to handle PnP manifests, locators, and fallback pools, ensuring that module resolution follows the PnP algorithm before falling back to standard Node.js resolution where appropriate.

internal/resolver · high confidence

The CLI now supports the 'local-css', 'global-css', 'copy', and 'empty' loaders. Users can specify these loader types via the command line to handle local CSS symbols, global CSS symbols, file copying, and empty module stubs respectively, in addition to the previously available loaders like 'css', 'js', and 'ts'.

_internal/cli\helpers · high confidence

Adds the internal CSS lexer, which converts CSS source files into a stream of tokens before parsing begins. This component handles tokenization of CSS-specific syntax including identifiers, strings, URLs, comments, and special delimiters, while also managing error recovery for issues like unterminated strings and invalid URL tokens.

_internal/css\lexer · high confidence

The internal CSS printer has been implemented to handle the final stage of CSS processing, converting the parsed AST into output CSS. This change introduces support for source map generation (including chunk-based mappings for symbols, combinators, and type selectors), configurable minification (whitespace, ASCII-only output, and line limits), and the extraction of legal comments. It also handles specific CSS features such as \@charset\, \@import\ with conditions, and proper escaping of special sequences like \\</style\>\ to prevent injection issues.

_internal/css\printer · high confidence

The build system now defines its core configuration structures and known global identifiers in the internal config package. This introduces support for modern JavaScript features, including automatic JSX runtime, TypeScript-specific options like \verbatimModuleSyntax\ and \preserveValueImports\, and new output loaders for binary, copy, and empty modules. It also establishes the foundation for tree-shaking by marking standard library static methods (e.g., \Array.from\, \Object.keys\) and symbols as side-effect free.

internal/config · high confidence

This change introduces the foundational infrastructure for CSS support in esbuild, including a new CSS lexer, parser, and AST representation (internal/css\_ast). It adds a browser compatibility table for CSS features (internal/compat/css\_table) to enable automatic lowering of modern CSS syntax for older browsers, and extends the core AST and import record structures (internal/ast/ast.go) to handle CSS-specific import kinds such as @import, url(), and composes. The package.json resolver (internal/resolver/package\_json.go) is also updated to support CSS-specific resolution logic, including handling of the 'browser' field for CSS modules and side-effect detection.

github.com/evanw/esbuild · high confidence

The module resolution logic is now implemented in Go, replacing the previous placeholder. The new resolver uses the actual file system to locate imports, supporting configurable file extension priorities (defaulting to .jsx, .js, .json) and caching both file contents and directory entries to improve performance. A test helper is also provided to create a map-based resolver for unit testing.

src/esbuild/resolver · high confidence

The logger now supports multiple output formats, including a new Visual Studio style for better integration with Visual Studio's problem matcher and a Clang style, alongside the existing default format. Users can also configure the log level for specific warnings and informational messages individually using message IDs, allowing for finer control over build output verbosity.

internal/logger · high confidence

Added a new internal caching system in the \internal/cache\ package that stores parsed ASTs for JavaScript, CSS, and JSON files, as well as file contents, to speed up subsequent builds. By reusing previously parsed results when file contents and parsing options remain unchanged, the tool reduces redundant work and improves build performance.

internal/cache · high confidence

The internal/helpers package has been added, providing a suite of utility functions including MIME type detection (supporting new types like AVIF, Markdown, and Webmanifest), glob pattern parsing, data URL encoding (with a shortest-path selection between base64 and percent-encoding), string quoting, and thread-safe synchronization primitives. This also includes helpers for UTF-16/UTF-8 conversion, typo detection, and performance-optimized string joining and hashing.

internal/helpers · high confidence

Added a new internal runtime package containing helper functions (such as \_\require, \\spreadValues, and \\_objRest) that are automatically injected into output files to implement language features like object spread, CommonJS emulation, and lazy ESM evaluation. The implementation includes logic to avoid ES6 syntax when targeting older environments and renames helpers to prevent collisions with TypeScript's tslib.

internal/runtime · high confidence

The CSS parser now includes dedicated logic to minify specific CSS declarations, such as box model properties (margin, padding, border-radius, box-shadow) and font properties, by compacting shorthand values and converting keywords to numeric equivalents (e.g., 'bold' to '700'). It also introduces support for modern CSS color spaces (oklch, oklab, lab, lch, display-p3, etc.) and gradient lowering, allowing the bundler to transform and minify complex color definitions for broader browser compatibility.

_internal/css\parser · high confidence

The \pkg/api\ package introduces a new Go library for integrating esbuild into other tools. It exposes the \Build\ function for end-to-end bundling and the \Transform\ function for single-file code transformation (e.g., minification, TypeScript/JSX compilation). The API includes options for source maps, legal comments, JSX modes, target environments, loaders, platforms, and formats. It also provides a \Serve\ function for a built-in development server with hot reloading, a polling-based \watcher\ for file change detection, and utilities for formatting error/warning messages and analyzing metafiles.

pkg/api · high confidence

The new \pkg/cli\ package exposes the esbuild command-line interface as a Go API, allowing users to run esbuild from Go code without spawning a child process. It provides \Run\ and \RunWithPlugins\ to execute builds, and \ParseBuildOptions\, \ParseTransformOptions\, and \ParseServeOptions\ to reuse CLI argument parsing logic for programmatic configuration. This location specifically implements the CLI argument parsing, the mangle cache JSON handling, and the public Go entry points, serving as the bridge between Go applications and esbuild's build, transform, and serve capabilities.

pkg/cli · high confidence

The JavaScript API now supports running the esbuild Go binary inside a Web Worker, enabling non-blocking builds in browser environments. This change introduces a new \worker\ option in the \initialize()\ call to spawn a dedicated worker thread, and adds a \wasmModule\ option to pass a pre-instantiated WebAssembly module for faster startup. The implementation includes a new \lib/shared/worker.ts\ file that handles the WebAssembly instantiation (preferring \instantiateStreaming\ with a fallback to \instantiate\) and manages stdin/stdout communication via \postMessage\. The \lib/shared/stdio\_protocol.ts\ defines the binary protocol used for communication between the main thread and the worker, while \lib/shared/common.ts\ and \lib/shared/types.ts\ provide the validation logic and TypeScript types for these new options.

lib/shared · high confidence

This entry introduces the initial implementation of the esbuild command-line interface and its underlying architecture, establishing version 0.28.2. The \cmd/esbuild\ package provides the \main.go\ entry point, which parses command-line arguments and exposes a comprehensive help text covering bundling, minification, JSX handling, watch mode, and various output options. It includes a long-running service (\service.go\) that communicates with host processes (like the JavaScript API) over a custom binary stdin/stdout protocol (\stdio\_protocol.go\), managing build contexts and active builds. Platform-specific behavior is handled via build tags, with \main\_other.go\ providing profiling capabilities (heap, trace, CPU profiles) for native binaries and \main\_wasm.go\ disabling these for WebAssembly. Tests (\service\_test.go\) verify that build requests properly release active builds even when errors occur.

cmd · high confidence

The \lexer\_test.go\ file containing the unit tests for the lexer (including tests for identifiers, numeric literals, and error handling) and the \tables.go\ file containing token-to-string mappings and JSX entity definitions have been deleted from the \src/esbuild/lexer\ package. This removes the internal test coverage and static lookup tables used by the lexer in this location.

src/esbuild/lexer · high confidence

The JavaScript/TypeScript printer implementation (printer.go) and its associated tests (printer\_test.go) have been deleted from the codebase. This removes the component responsible for converting the abstract syntax tree back into source code, including logic for handling source maps, string escaping, and minification.

src/esbuild/printer · high confidence

The main command-line interface file for the esbuild tool (src/esbuild/main/main.go) has been deleted. This removes the local argument parsing, help text, and CLI execution logic that previously handled options such as --bundle, --minify, --define, and output path configuration.

src/esbuild/main · high confidence

The legacy Go-based parser implementation (including the main parser, JSON parser, and associated tests) has been removed from the codebase. This change eliminates the previous parsing logic for JavaScript, TypeScript, and JSON files, indicating a shift to a different parsing backend or architecture.

src/esbuild/parser · high confidence

The file src/esbuild/logging/logging.go has been deleted, removing the previous logging subsystem that handled asynchronous error and warning streams, terminal width detection via stty, and message formatting. This change eliminates the code responsible for the old logging behavior, indicating a migration to a different logging mechanism elsewhere in the codebase.

src/esbuild/bundler, src/esbuild/logging · high confidence

The JavaScript parser implementation has been reorganized into a new package structure, splitting the previous monolithic code into focused files: a new global name parser for resolving global identifiers, a main parser module handling AST creation and symbol binding, a dedicated module for syntax lowering (converting modern JS to older targets), and a specific module for class lowering logic. This refactoring also introduces a new test suite for the lowering pass, covering scenarios like arrow function transformation, nullish coalescing, and argument scope handling.

_internal/js\parser · high confidence

The internal JavaScript AST data structures, operator precedence constants, and helper functions have been moved into a new \internal/js\_ast\ package. This separation isolates JavaScript-specific AST logic (such as identifier validation, operator tables, and expression simplification helpers) from the generic \ast\ package, improving code organization and maintainability for the parser and minifier components.

_internal/js\ast · high confidence

The linker's internal data model has been reorganized into a new 'graph' package. This change introduces dedicated types such as LinkerGraph, LinkerFile, and EntryPoint to manage the set of files, entry points, and symbols that the linker operates on. By centralizing this data, the bundler can better handle immutable input sharing, parallel graph cloning for performance, and deterministic ordering of reachable files, laying the groundwork for improved code splitting and incremental build support.

internal/graph · high confidence

The internal linker logic has been extracted into its own package to allow a new linker implementation to coexist in the codebase, facilitating a gradual rewrite with minimal disruption. Additionally, a new debug mode has been added that generates verbose metafile data (controlled by the \debugVerboseMetafile\ constant) to help debug the module graph when loaded in \graph-debugger.html\.

internal/linker · high confidence

The internal bundler has been rewritten to support new incremental build APIs, introducing a two-phase process consisting of a module graph scan (ScanBundle) followed by output generation (Compile). This change restructures the core bundling logic, moving module representation into the graph, separating the linker into its own package, and refactoring the API to improve performance and maintainability for build tools.

internal/bundler · high confidence

The esbuild-wasm binary now uses a two-step WebAssembly instantiation API to significantly reduce startup time (approximately 1 second faster) and includes workarounds for Node.js bugs affecting stdin reading on Windows and Unicode handling in stdout/stderr. It also filters environment variables to prevent crashes with Go 1.17.2+ generated WASM modules in high-variable environments.

npm/esbuild-wasm/bin · high confidence

The internal hashing mechanism in the xxhash package has been replaced with a 64-bit xxHash (XXH64) implementation, sourced from the cespare/xxhash library. This change introduces a new internal package containing the xxHash algorithm, its license, and documentation, replacing the previous SHA1-based approach to improve performance.

internal/xxhash · high confidence

This change introduces a new \css\_decl\_table.go\ file that defines a comprehensive enumeration of CSS properties (such as \DAlignContent\, \DAnimation\, \DGrid\, etc.) for the internal CSS AST, replacing or augmenting previous property handling mechanisms. Alongside this structural addition, the CSS processing behavior has been refined to support local \composes\ and local container names via \local-css\, shorten \top\/\right\ properties into the \inset\ property, and include basic typo detection for CSS properties. These updates improve CSS parsing accuracy, support for modern CSS features like container queries and local composition, and provide better error feedback for common typos.

_internal/css\ast · high confidence

The JavaScript lexer has been moved from src/esbuild/lexer to internal/js\_lexer and refactored to support new language features and improved internal structure. The lexer now recognizes hashbang comments (\#!/usr/bin/env node) and class-private identifiers (TPrivateIdentifier), and strict mode reserved words are now exposed via a dedicated map rather than token constants. Comment handling has been enhanced to track legal comments and other comments as ranges before tokens, enabling better preservation and error reporting. The token type is now uint8 for compactness, and the lexer no longer relies on the unsafe package for string substring tracking, using a MaybeSubstring struct instead.

_internal/js\lexer · high confidence

The JavaScript printing logic has been moved into a dedicated \internal/js\_printer\ package, replacing the previous location. This change includes the full printer implementation in \js\_printer.go\ and a comprehensive test suite in \js\_printer\_test.go\ that validates number formatting, minification, and mangling behavior.

_internal/js\printer · high confidence

The internal file system implementation has been restructured into separate files to improve maintainability and platform compatibility. This change introduces a custom path-handling layer (forked from Go's standard library) to work around WebAssembly build bugs, ensuring correct path resolution on Windows and WASM targets. It also enhances the mock file system to support multiple volumes on Windows, improving test accuracy. Watch mode reliability is improved by tracking directory access more precisely (distinguishing between individual entry access and full directory listing) and by treating specific Windows errors like ERROR\_INVALID\_NAME as ENOENT. Additionally, modification keys now use inode and nanosecond precision on Unix systems for more accurate change detection.

internal/fs · high confidence

The source map logic has been moved from the main compiler package into a new \internal/sourcemap\ module. This change introduces a dedicated \Mapping\ struct that explicitly tracks UTF-16 code unit counts for generated and original columns, and adds support for storing \names\ in the source map output. The module also includes optimized VLQ encoding/decoding functions and a binary search implementation for efficient mapping lookups, improving performance and correctness for source map handling.

internal/sourcemap · high confidence

The internal/renamer package has been rewritten to support more robust symbol mangling, including fixes for reserved word collisions (such as 'if' and JSX uppercase requirements), property name mangling, and direct eval edge cases. The new implementation introduces parallelized symbol counting for performance improvements and ensures deterministic output by using stable source indices for sorting, while also moving identifier handling logic from the lexer to the AST layer.

internal/renamer · high confidence

The Node.js wrapper script located at npm/esbuild-windows-64/bin/esbuild has been removed. This script previously served as an indirection layer to launch the native esbuild.exe binary on Windows, bypassing npm's handling of executable extensions. Its removal changes how the Windows binary is invoked, eliminating the Node.js boot-up overhead previously incurred by this shim.

npm/esbuild-windows-64 · high confidence

The \src/esbuild/ast/ast.go\ file, which previously contained the core AST data structures including operator precedence levels (\L\), operator codes (\OpCode\), and the operator lookup table (\OpTable\), has been deleted. This change removes the internal definitions for JavaScript/TypeScript operator precedence and unary/binary operator types from this specific location, indicating a restructuring of how the AST represents these language constructs.

src/esbuild/ast · medium confidence

The internal tool that generates esbuild's browser compatibility tables has been rewritten in TypeScript, replacing the previous implementation. This new system aggregates data from multiple third-party sources—including MDN, caniuse-lite, and the kangax/compat-table repository—to produce more accurate and up-to-date support tables for both JavaScript and CSS features. Users benefit from improved coverage of modern features (such as CSS color functions, import attributes, and explicit resource management) and more reliable prefix handling for CSS properties, ensuring that esbuild's target environment logic better reflects actual browser capabilities.

compat-table · high confidence

The internal compatibility layer now supports version ranges and semantic versioning (semver) with pre-release identifiers. This allows the tool to correctly evaluate target environment versions against defined ranges, ensuring that pre-release versions (e.g., '1.0.0-alpha') are handled according to semver rules (where a release version is greater than its pre-release counterpart). This change improves the accuracy of feature compatibility checks when targeting specific or pre-release versions of JavaScript environments.

internal/compat · high confidence

The esbuild npm package has been reorganized into scoped packages (e.g., @esbuild/linux-x64) and split into distinct entry points for different environments. The new lib/npm/browser.ts provides a WebAssembly-based API for browsers, requiring explicit initialization with a wasmURL or wasmModule and disabling synchronous APIs. The lib/npm/node.ts and lib/npm/node-platform.ts files handle Node.js environments, supporting a wider range of platforms (including riscv64, loong64, OpenBSD, NetBSD, and OpenHarmony) and introducing an ESBUILD\_BINARY\_PATH environment variable override. The install script (lib/npm/node-install.ts) now includes integrity checks for downloaded binaries and improved error handling for various package managers and platforms.

lib/npm · high confidence

Added Yarn PnP and TypeScript compatibility test fixtures; Added comprehensive bundler test suite; Added scripts for data URL escaping validation and decorator testing; Extracted test helpers and diff utilities into the internal/test package; New standalone browser test runner for esbuild-wasm.

The build environment has been updated to use Go 1.26.4. This change ensures the project is compiled with the latest Go toolchain, which may include performance improvements and bug fixes from the Go runtime.

(repo-wide) · high confidence

This release updates the esbuild bundler to version 0.28.2, adding new platform-specific binary packages for IBM AIX (ppc64), OpenHarmony (arm64), NetBSD (arm64), and SunOS (x64) to broaden operating system coverage. The core package now requires Node.js 18 or later. Internal tooling dependencies have been updated, including TypeScript to 6.0.2 in the lib directory and the compat-table data sources to @mdn/browser-compat-data 7.3.9 and caniuse-lite 1.0.30001784. Benchmark and requirement test environments have also been refreshed with newer versions of Rollup (4.0.2), Parcel (2.10.0), and Webpack (5.88.2).

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 40 → 46 (+6.4)
• Rubric changed (rubric-2026.08.19 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 54 → 58 (+4.2)
• Architecture 65 → 82 (+17.0)
• Maturity 57 → 51 (-6.0)
• Readiness 35 → 61 (+26.3)
• Security 40 → 45 (+4.8)
• Accessibility 39 → 40 (+0.9)

• Coverage not included — suite not readable by the collector
• Critical CVE: [GHSA redacted] (scripts/browser/package-lock.json)
• Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• Duplicated block (10 lines × 2) (cmd/esbuild/service.go)
• Duplicated block (10 lines × 2) (internal/bundler/bundler.go)
• Duplicated block (10 lines × 2) (internal/cache/cache_ast.go)
• Duplicated block (10 lines × 2) (internal/js_ast/js_ast_helpers.go)
• Duplicated block (10 lines × 2) (internal/js_ast/js_ident.go)
• Duplicated block (10 lines × 2) (internal/js_lexer/js_lexer.go)
• Duplicated block (10 lines × 2) (internal/js_lexer/js_lexer.go)
• Duplicated block (10 lines × 2) (internal/js_parser/js_parser.go)
• Duplicated block (10 lines × 2) (internal/js_parser/js_parser.go)
• Duplicated block (10 lines × 2) (internal/js_parser/js_parser.go)
• Duplicated block (10 lines × 2) (internal/js_printer/js_printer.go)
• Duplicated block (10 lines × 2) (internal/linker/linker.go)
• Duplicated block (10 lines × 2) (internal/linker/linker.go)
• Duplicated block (10 lines × 2) (pkg/api/api_impl.go)
• Duplicated block (10 lines × 3) (pkg/api/serve_other.go)
• Duplicated block (10 lines × 4) (internal/js_printer/js_printer.go)
• Duplicated block (11 lines × 2) (cmd/esbuild/service.go)
• …and 176 more

• ClassTooLong: HelperContext (internal/js_ast/js_ast_helpers.go)
• ClassTooLong: Lexer (internal/js_lexer/js_lexer.go)
• ClassTooLong: lexer (internal/css_lexer/css_lexer.go)
• ClassTooLong: linkerContext (internal/linker/linker.go)
• ClassTooLong: lowerClassContext (internal/js_parser/js_parser_lower_class.go)
• ClassTooLong: parser (internal/js_parser/js_parser.go)
• ClassTooLong: printStmtFlags (internal/js_printer/js_printer.go)
• ClassTooLong: printer (internal/css_printer/css_printer.go)
• ClassTooLong: printer (internal/js_printer/js_printer.go)
• ClassTooLong: resolverQuery (internal/resolver/resolver.go)
• ClassTooLong: scanner (internal/bundler/bundler.go)
• ClassTooLong: serviceType (cmd/esbuild/service.go)
• Critical CVE: [GHSA redacted] (scripts/browser/package-lock.json)
• Dependency pinned to a stale untagged commit: golang.org/x/sys
• Duplicated block (10 lines × 2) (cmd/esbuild/service.go)
• Duplicated block (10 lines × 2) (internal/js_ast/js_ast_helpers.go)
• Duplicated block (10 lines × 2) (internal/js_lexer/js_lexer.go)
• Duplicated block (10 lines × 2) (internal/js_parser/ts_parser.go)
• Duplicated block (10 lines × 2) (internal/linker/linker.go)
• Duplicated block (10 lines × 2) (internal/linker/linker.go)
• …and 378 more

• 34 commits — 19 feature/other, 15 fixes

• (root) — 9 commits
• internal/js_parser — 5 commits
• internal/css_parser — 4 commits
• .github/workflows — 3 commits
• internal/bundler_tests — 3 commits
• internal/logger — 3 commits
• pkg/api — 3 commits
• cmd/esbuild — 1 commit
• internal/compat — 1 commit
• lib/npm — 1 commit
• npm/@esbuild — 1 commit

• fix: attempt to fix ci on windows
• fix: close #3701, fix #3896: temp ref child for kill
• fix: css: fix green/blue channel swap in oklch gamut mapping (#4488)
• fix: fix #4411: prevent duplicate chunks from merging
• fix: fix #4460: add --log-style=visualstudio
• fix: fix #4484: avoid overwriting input files
• fix: fix #4485, close #4487: audio/mpeg for .mp3
• fix: fix #4497: preserve nested ampersands during minification (#4500)
• fix: fix #4498: async TLA checks need a worklist
• fix: fix #4507: import assignment tree-shaking bug
• fix: fix #4508, close #4510: minify bug with ||=
• fix: fix #4509: pick minimum version for target env
• fix: fix service deadlock after failed build setup (#4506)
• fix: fixes for tests
• fix: release notes for css nesting bugfix
• change: add es2026 as a target
• change: add a clang format style
• change: add to release notes
• change: better isolation of current part in js parser
• change: css: adjust parser to allow --foo: {...}
• …and 14 more

• Unchanged — 0 containers · 1 contexts · 0 edges

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

evanw/esbuild was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.