CodeVetter · Repo Unpack · Risk map
evanw/esbuild
esbuild treats source text as trusted and says the dev server is not a security boundary. The sharp edges are the install-time binary download, the unauthenticated local IPC service, filesystem writes at absolute paths, and the size of the parser and linker. Go 1.13 compatibility and the path/filepath ban make casual modern-Go edits break the build. The architecture doc disagrees with the CLI on whether tree shaking can be turned off.
- node-install.ts downloads missing platform binaries by running npm install of @esbuild/<pkg>@<version> via child_process.execSync, and as a last resort https.get of https://registry.npmjs.org/<pkg>/-/<tarball>.tgz. extractFileFromTarGzip pulls package/<subpath> out of the gzip.
- binaryIntegrityCheck sha256s the bytes and compares them to packageJSON['esbuild.binaryHashes'][pkg/subpath]. A missing or mismatched hash throws. The check is skipped when ESBUILD_BINARY_PATH is set and the file exists.
- validateBinaryVersion runs the chosen binary with --version via execFileSync and throws if stdout does not equal packageJSON.version. On macOS it special-cases _SecTrustEvaluateWithError and suggests esbuild-wasm or an older Go.
- The stdin/stdout service has no authentication. Any local process that can speak the length-prefixed protocol can request build, transform, serve, or resolve. --service refuses to start only when the host version string mismatches.
- The Makefile comment states esbuild is not a security boundary: it transforms trusted source text and the dev server is a read-only view of source not intended for production. Serve still checks Host to block DNS rebinding and rejects Windows backslashes in URLs.
- rebuildImpl writes output with ioutil.WriteFile at absolute paths using mode 0666, or 0777 when IsExecutable, and os.Remove on outputs that disappeared between rebuilds. AllowOverwrite is forced when Write is false so serve can use input paths as output paths.
- OnLoad and OnResolve plugins supply file contents and paths. JS plugins cross the service boundary; a plugin callback can therefore cause the Go process to parse and later write whatever bytes the plugin returns.
- docs/architecture.md says tree shaking is always active and cannot be disabled. The CLI and TransformOptions both expose a tree-shaking switch, and validateTreeShaking is called from transformImpl. The architecture page is stale on that point. (inferred)
- publish.yml has id-token: write and contents: write, builds every platform, refuses a dirty git status, installs npm 11.5.1, runs make publish-all, pushes tag v$ESBUILD_VERSION, and creates a GitHub Release from the CHANGELOG section. A version.txt push to main is the release trigger.
- Parser panics that are not js_lexer.LexerPanic are re-panicked in js_parser.Parse. parseFile has its own recover that turns any panic into a log error with a stack, so a parser crash becomes a failed file rather than a dead process during scan.
- staticcheck.conf sets checks = [] and the comment says the author disabled the VS Code Go linter on purpose. Agents should not assume staticcheck is an enforced gate.
- ioutil is still used in api_impl.go and the install path uses sync npm install. That is consistent with the Go 1.13 floor, but edits that use newer stdlib-only APIs or generics will fail the Go 1.13 CI job even if local Go 1.26 accepts them.