Skip to content

fix: move esbuild to devDependencies#2136

Open
frenzzy wants to merge 1 commit intosolidjs:mainfrom
frenzzy:fix/esbuild-dev-dependency
Open

fix: move esbuild to devDependencies#2136
frenzzy wants to merge 1 commit intosolidjs:mainfrom
frenzzy:fix/esbuild-dev-dependency

Conversation

@frenzzy
Copy link
Copy Markdown
Contributor

@frenzzy frenzzy commented Apr 12, 2026

Summary

  • Move esbuild from dependencies to devDependencies in packages/start/package.json

Motivation

esbuild is only imported in build-time Vite plugin code (src/config/fs-routes/router.ts) and is never used by the production server output (.output/server/). Having it in dependencies causes:

  1. Docker image bloat: esbuild ships a platform-specific Go binary (~9 MB) that gets installed even with npm ci --omit=dev
  2. False-positive security findings: Security scanners (e.g., Trivy) flag Go stdlib CVEs in the esbuild binary that are not exploitable at runtime

Since vite (which itself depends on esbuild) is already a peerDependency, esbuild will always be available during the build step.

Closes #2135

🤖 Generated with Claude Code

esbuild is only imported in build-time Vite plugin code
(src/config/fs-routes/router.ts) and is never used by the
production server output. Having it in dependencies causes
unnecessary Docker image bloat (~9MB Go binary) and
false-positive security scanner findings (Go stdlib CVEs
in the esbuild binary).

Closes solidjs#2135

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Apr 12, 2026

⚠️ No Changeset found

Latest commit: 1b5b65e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@netlify
Copy link
Copy Markdown

netlify bot commented Apr 12, 2026

Deploy Preview for solid-start-landing-page ready!

Name Link
🔨 Latest commit 1b5b65e
🔍 Latest deploy log https://app.netlify.com/projects/solid-start-landing-page/deploys/69db52fb3e52ec000896d6eb
😎 Deploy Preview https://deploy-preview-2136--solid-start-landing-page.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

esbuild should not be a production dependency

1 participant