Bump esbuild and esbuild-loader by dependabot[bot] · Pull Request #8580 · microsoft/vscode-pull-request-github

dependabot · 2026-03-10T11:05:18Z

Bumps esbuild to 0.27.3 and updates ancestor dependency esbuild-loader. These dependencies need to be updated together.

Updates esbuild from 0.21.5 to 0.27.3

Release notes

v0.27.3
Preserve URL fragments in data URLs (#4370)

Consider the following HTML, CSS, and SVG:
index.html:
<!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>
icons.css:
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
triangle.svg:
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>
The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:
/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

9129e00 publish 0.27.3 to npm
e20e411 small fix to release notes
0dc0f2d fix #4322: parse and print CSS @scope rules
55fe391 update firefox css gradient support
2c35297 update gradient lowering transform
9209e44 Update Go to 1.25.7 (#4388)
e8d861b close #4374: compat table for the using feature
19b8887 no longer need williamkapke/node-compat-table
7e44218 the kangax/compat-table repo moved to a new url
23b9338 run make update-compat-table
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

Updates esbuild-loader from 4.2.2 to 4.4.2

Release notes

Sourced from esbuild-loader's releases.

v4.4.2

4.4.2 (2025-12-29)

Bug Fixes

warn when define is used with eval-based devtools (dfec00d)

v4.4.1

4.4.1 (2025-12-21)

Bug Fixes

upgrade esbuild to ^0.27.1 (#385) (80e2b36)

v4.4.0

4.4.0 (2025-10-05)

Bug Fixes

defer to default get-tsconfig cache to pass type-check (aa4b79d)

remove incorrect tsconfig include pattern warning (#1) (c5cd779)

Features

upgrade deps (daaf613)

v4.3.0

4.3.0 (2025-02-11)

Features

upgrade esbuild to ^0.25 (#382) (42ec34f)

Commits

dfec00d fix: warn when define is used with eval-based devtools
7910e16 chore(deps): update pnpm to v10 (#393)
6da96f3 ci(github-actions): update github-actions to v6 (major) (#395)
80e2b36 fix: upgrade esbuild to ^0.27.1 (#385)
1d38009 chore(deps): update dependency @types/webpack-sources to v1 (#386)
656d9fe chore(deps): update dependency @types/node to v22 (#392)
13399ef chore(deps): update dependency webpack-merge to v6 (#390)
c4bb50d ci: migrate to npm trusted publishers (OIDC)
31c9066 ci(github-actions): update actions/checkout digest to 34e1148 (#13)
e206099 ci: restrict renovate upgrades
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild-loader since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [esbuild](https://github.com/evanw/esbuild) to 0.27.3 and updates ancestor dependency [esbuild-loader](https://github.com/privatenumber/esbuild-loader). These dependencies need to be updated together. Updates `esbuild` from 0.21.5 to 0.27.3 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.21.5...v0.27.3) Updates `esbuild-loader` from 4.2.2 to 4.4.2 - [Release notes](https://github.com/privatenumber/esbuild-loader/releases) - [Commits](privatenumber/esbuild-loader@v4.2.2...v4.4.2) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.27.3 dependency-type: indirect - dependency-name: esbuild-loader dependency-version: 4.4.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 10, 2026

alexr00 enabled auto-merge (squash) March 10, 2026 11:06

alexr00 approved these changes Mar 10, 2026

View reviewed changes

alexr00 merged commit e6c4ffa into main Mar 10, 2026
4 checks passed

alexr00 deleted the dependabot/npm_and_yarn/multi-e4ece79a65 branch March 10, 2026 11:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump esbuild and esbuild-loader#8580

Bump esbuild and esbuild-loader#8580
alexr00 merged 1 commit intomainfrom
dependabot/npm_and_yarn/multi-e4ece79a65

dependabot Bot commented on behalf of github Mar 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Mar 10, 2026

v0.27.3

Changelog: 2024

0.24.2

0.24.1

v4.4.2

4.4.2 (2025-12-29)

Bug Fixes

v4.4.1

4.4.1 (2025-12-21)

Bug Fixes

v4.4.0

4.4.0 (2025-10-05)

Bug Fixes

Features

v4.3.0

4.3.0 (2025-02-11)

Features

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant