Bump esbuild from 0.16.5 to 0.16.6

[dependabot]

Bumps esbuild from 0.16.5 to 0.16.6.

Release notes

Sourced from esbuild's releases.

v0.16.6

• Do not mark subpath imports as external with --packages=external (#2741)

  Node has a feature called subpath imports where special import paths that start with # are resolved using the imports field in the package.json file of the enclosing package. The intent of the newly-added --packages=external setting is to exclude a package's dependencies from the bundle. Since a package's subpath imports are only accessible within that package, it's wrong for them to be affected by --packages=external. This release changes esbuild so that --packages=external no longer affects subpath imports.

• Forbid invalid numbers in JSON files

  Previously esbuild parsed numbers in JSON files using the same syntax as JavaScript. But starting from this release, esbuild will now parse them with JSON syntax instead. This means the following numbers are no longer allowed by esbuild in JSON files:

  • Legacy octal literals (non-zero integers starting with 0)
  • The 0b, 0o, and 0x numeric prefixes
  • Numbers containing _ such as 1_000
  • Leading and trailing . such as 0. and .0
  • Numbers with a space after the - such as - 1

• Add external imports to metafile (#905, #1768, #1933, #1939)

  External imports now appear in imports arrays in the metafile (which is present when bundling with metafile: true) next to normal imports, but additionally have external: true to set them apart. This applies both to files in the inputs section and the outputs section. Here's an example:

   {
     "inputs": {
       "style.css": {
         "bytes": 83,
         "imports": [
  +        {
  +          "path": "https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css",
  +          "kind": "import-rule",
  +          "external": true
  +        }
         ]
       },
       "app.js": {
         "bytes": 100,
         "imports": [
  +        {
  +          "path": "https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/js/bootstrap.min.js",
  +          "kind": "import-statement",
  +          "external": true
  +        },
           {
             "path": "style.css",
             "kind": "import-statement"
           }
         ]
       }
     },
     "outputs": {
       "out/app.js": {
         "imports": [

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.16.6

• Do not mark subpath imports as external with --packages=external (#2741)

  Node has a feature called subpath imports where special import paths that start with # are resolved using the imports field in the package.json file of the enclosing package. The intent of the newly-added --packages=external setting is to exclude a package's dependencies from the bundle. Since a package's subpath imports are only accessible within that package, it's wrong for them to be affected by --packages=external. This release changes esbuild so that --packages=external no longer affects subpath imports.

• Forbid invalid numbers in JSON files

  Previously esbuild parsed numbers in JSON files using the same syntax as JavaScript. But starting from this release, esbuild will now parse them with JSON syntax instead. This means the following numbers are no longer allowed by esbuild in JSON files:

  • Legacy octal literals (non-zero integers starting with 0)
  • The 0b, 0o, and 0x numeric prefixes
  • Numbers containing _ such as 1_000
  • Leading and trailing . such as 0. and .0
  • Numbers with a space after the - such as - 1

• Add external imports to metafile (#905, #1768, #1933, #1939)

  External imports now appear in imports arrays in the metafile (which is present when bundling with metafile: true) next to normal imports, but additionally have external: true to set them apart. This applies both to files in the inputs section and the outputs section. Here's an example:

   {
     "inputs": {
       "style.css": {
         "bytes": 83,
         "imports": [
  +        {
  +          "path": "https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css",
  +          "kind": "import-rule",
  +          "external": true
  +        }
         ]
       },
       "app.js": {
         "bytes": 100,
         "imports": [
  +        {
  +          "path": "https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/js/bootstrap.min.js",
  +          "kind": "import-statement",
  +          "external": true
  +        },
           {
             "path": "style.css",
             "kind": "import-statement"
           }
         ]
       }
     },
     "outputs": {
       "out/app.js": {

... (truncated)

Commits

• ee8e0dd publish 0.16.6 to npm
• cfc3367 the previous change also fixes #1768
• f2f78ef add external imports to metafile
• 7fcfe73 more metafile test coverage
• df7ce2a feat: support npm_config_registry env variable (#2743)
• 6ecf729 add flavor to json parser
• a98ba36 forbid invalid numbers in json files
• b69ad87 fix #2741: --packages=external + subpath imports
• 8ccfdd5 add failing test case for webpack
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)