npm / esbuild

esbuild

What changed in esbuild 0.25 to 0.28, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

5 breaking3 security1 deprecations4 new APIs and options2 performance10 behavior and defaults1 tooling23 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.1.1 on npm

esbuild 0.2821 changes

Breaking changes 1

Repeated import() or require() calls now throw the same error each time when module evaluation throws.
0.28.1release notes

Security 3

The Deno install script now checks binary integrity and errors if a downloaded binary differs from the expected content, including when using a custom NPM_CONFIG_REGISTRY.
0.28.1release notes
Requests with paths containing backslashes are now rejected, preventing Windows path traversal outside the serve directory.
0.28.1release notes security advisory
The install script now verifies that a fallback-downloaded platform binary matches the expected hash for the current release.
0.28.0release notes

Deprecations 1

Adds a warning for TypeScript cast syntax that is valid in TypeScript 6 but becomes a syntax error in TypeScript 7 and has unintuitive precedence.
0.28.2release notes

New APIs and options 3

The Visual Studio log style is available through the JS and Go APIs and can be used with the existing formatMessages API.
0.28.2release notes
Adds a Visual Studio log style for displaying esbuild messages in Visual Studio and other tools in the MSBuild ecosystem.
0.28.2release notes
esbuild now supports text imports using the import text proposal syntax, behaving the same as the existing text loader.
0.28.0release notes

Behavior and default changes 1

When a target engine is specified multiple times, esbuild now uses the minimum version among the duplicates.
0.28.2release notes

Fixes and other changes 12

Input files are no longer overwritten when a build error occurs unless --allow-overwrite is explicitly present.
0.28.2release notes
Corrects fallback colors generated for CSS colors outside the sRGB gamut.
0.28.2release notes
Prevents the CSS minifier from removing & when doing so is unsafe.
0.28.2release notes
Files ending in .mp3 now always use the audio/mpeg MIME type.
0.28.2release notes
Fixes a reference-counting bug that could cause the native executable to report a deadlock when an incorrectly used API request returns an error.
0.28.2release notes
Fixes incorrect minified output when logical assignment operators are lowered for older target environments.
0.28.2release notes
Fixes generated code in complex scenarios involving top-level await in a dependency cycle.
0.28.2release notes
Fixes incorrect tree shaking of imports used in a TypeScript type alias under certain circumstances.
0.28.2release notes
Complex expressions in a new expression's target are now correctly parenthesized in generated code, avoiding syntax errors or changed semantics.
0.28.1release notes
When targeting ES5, TypeScript-only import assignment constructs now emit var instead of const.
0.28.1release notes
The minifier no longer inlines using or await using declarations into subsequent uses, preserving correct resource disposal.
0.28.1release notes
Hoisted nested var declarations are now treated as module-level symbols during name collision avoidance, preventing collisions when bundling without minification.
0.28.1release notes

esbuild 0.2722 changes

Breaking changes 4

With useDefineForClassFields: true in tsconfig.json, parameter properties now generate class field declarations.
0.27.5release notes
Using declarations inside switch case and default clauses are now syntax errors; wrap each case body in a block instead.
0.27.2release notes
The minifier strips empty finally clauses, potentially allowing the associated try statement to be removed from minified output.
0.27.1release notes
Running esbuild now requires Linux kernel 3.2 or later, or macOS 12 (Monterey) or later.
0.27.0release notes

Performance 2

Metafile JSON is generated without whitespace when the bundle is significantly large, slightly reducing its size.
0.27.4release notes
Minification now uses additional patterns to reduce switch statements, including converting some to conditional expressions.
0.27.2release notes

Behavior and default changes 6

esbuild now parses and prints CSS @scope rules, respects local/global status in selector lists for CSS modules, and slightly improves selector minification.
0.27.3release notes
Import path specifiers starting with #/ are now allowed, enabling wildcard mappings such as #/* to ./src/*.
0.27.2release notes
esbuild now automatically adds the -webkit- vendor prefix for the CSS mask shorthand property.
0.27.2release notes
Minifier inlining now also works when an IIFE body contains a single expression statement, rather than only a single return statement.
0.27.1release notes
Calling Symbol is considered side-effect free when its argument is known to be a primitive value, allowing module-level symbol variables to be tree-shaken.
0.27.1release notes
The binary loader now uses Uint8Array.fromBase64 when available in the configured target environment, falling back to its previous code otherwise. You may need to specify target when using this feature with Node.
0.27.0release notes

Fixes and other changes 10

Generated class fields for TypeScript parameter properties are now correctly lowered when the configured target environment does not support class fields.
0.27.7release notes
Fixes transformed async generators so concurrent polling works correctly.
0.27.5release notes
With metafile enabled, builds with errors now return an object containing the build errors instead of throwing an error about an empty JSON string.
0.27.5release notes
Fixes printing media queries using the <media-type> and <media-condition-without-or> grammar by wrapping or clauses in parentheses.
0.27.4release notes
Fixes an edge case where inject could fail with arbitrary module namespace names exported using export {} from when bundling is disabled and the target does not support those names.
0.27.4release notes
For metafiles too large to fit in a JavaScript string, the JavaScript API now attempts to parse the UTF-8 JSON bytes with a fallback parser instead of using JSON.parse.
0.27.4release notes
The minifier no longer incorrectly strips the variable in the automatically generated catch clause of lowered for await loops.
0.27.3release notes
The CSS bundler now preserves URL fragments when bundling SVG files with the dataurl loader, preventing broken references.
0.27.3release notes
The minifier restricts moving a label inside a try statement to loops generated by esbuild's for await transform, fixing output for code using labels, try, and loops.
0.27.1release notes
The bundler now hoists top-level var declarations outside the lazy ES module wrapper when needed for correctness.
0.27.1release notes

esbuild 0.256 changes

New APIs and options 1

esbuild now supports byte imports, behaving exactly like its existing binary loader.
0.25.11release notes

Behavior and default changes 3

Adds Atomics, SharedArrayBuffer, BigInt64Array, BigUint64Array, FinalizationRegistry, WeakRef, Float16Array, and Iterator to the globals considered side-effect-free when accessed, enabling additional tree-shaking.
0.25.12release notes
The CSS minifier removes rules whose selectors contain :is() and :where() when those selectors will never match.
0.25.12release notes
esbuild transforms CSS media query range syntax into equivalent min-/max-prefixed syntax for older browsers.
0.25.11release notes

Tooling 1

Adds improved pretty-printing and minifying support for the @view-transition CSS rule.
0.25.12release notes

Fixes and other changes 1

Fixes minification incorrectly deduplicating media rules with different suffix clauses.
0.25.12release notes