Skip to content

Move turf.min.js builds to esbuild#3076

Draft
mfedderly wants to merge 1 commit into
masterfrom
mf/esbuild
Draft

Move turf.min.js builds to esbuild#3076
mfedderly wants to merge 1 commit into
masterfrom
mf/esbuild

Conversation

@mfedderly

Copy link
Copy Markdown
Collaborator

This drops rollup and babel and gives us a single modern bundler to keep up to date. The target for esbuild was taken from browserslist's 'default' setting as of 2026-06-21 and then changed to the esbuild syntax.

Babel and rollup keep hitting us with CVEs and have large npm ecosystem dependency trees. Esbuild has intentionally restricted themselves to only taking an additional dependency on a single set of APIs from Google themselves. In the event of an esbuild vulnerability the difficulty of an update should be limited. Currently we're having issues updating rollup to remove vulnerability warnings because it changes the output and it fails our own es5 checks for turf.min.js.

This drops rollup and babel and gives us a single modern bundler to keep up to date.
The target for esbuild was taken from browserslist's 'default' setting as of 2026-06-21 and then changed to the esbuild syntax.

Babel and rollup keep hitting us with CVEs and have large npm ecosystem dependency trees. Esbuild has intentionally restricted themselves
to only taking an additional dependency on a single set of APIs from Google themselves. In the event of an esbuild vulnerability the
difficulty of an update should be limited. Currently we're having issues updating rollup to remove vulnerability warnings
because it changes the output and it fails our own es5 checks for turf.min.js.
@mfedderly mfedderly added this to the v8 milestone Jun 22, 2026
@mfedderly mfedderly added the bundling Anything related to issues with bundling label Jun 22, 2026
@mfedderly

Copy link
Copy Markdown
Collaborator Author

I'm curious for feedback on this if anyone else has a bundling tool that should be considered alongside esbuild. This was pretty easy to create (which makes me happy, but also makes it easy to throw away if another bundler is better).

(Some of the) Factors I'm considering when judging bundlers:

  • Do they have a minimal dependency story?
  • Who has ownership of the code and binaries that may be shipped into npm?
  • How does their history of CVE/GHSE's look? (esbuild actually has a recent CVE, so its not disqualifying)
  • What does the upgrade story look like for taking new versions?
  • turf.min.js output size and time to process

@mfedderly

Copy link
Copy Markdown
Collaborator Author

Note that this PR does not deduplicate the eslint version with tsup (which I'd like to remove, which will fix the dependency situation), and babel is still transitively required through documentation which has its own dependabot struggles.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bundling Anything related to issues with bundling

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant