esbuild breaking changes

0.28.1

2 breaking changes, first published June 11, 2026.

• Behavior changed
  Requests to the local development server whose paths contain a backslash are no longer allowed, as part of a fix for a path traversal issue on Windows. Code that relies on such requests must use forward slashes instead. github.com
• Behavior changed
  The Deno API now checks the integrity of the downloaded esbuild binary and errors on a mismatch. A custom registry set through NPM_CONFIG_REGISTRY must serve the expected executable content. github.com

0.28.0

1 breaking change, first published April 2, 2026.

• Behavior changed
  If esbuild's platform package install fails and the fallback download runs, the downloaded binary is now checked against an embedded hash. Downloads that do not match will fail, and the release is marked as breaking. github.com

0.25.0

9 breaking changes, first published February 8, 2025.

• Removed ServeResult.host
  ServeResult.host was removed in esbuild 0.25.0 npmjs.com
• Behavior changed
  Console dropping now replaces only one level of method call, so console.log.bind(console) keeps working. Code relying on deeper console calls being removed must change. github.com
• Behavior changed
  A port of 0 in the CLI and JS API now asks the OS for a random ephemeral port rather than defaulting to 8000. Use -1 in the Go API for a random port. github.com
• Behavior changed
  If a rebuild fails in watch mode, esbuild now deletes all output files instead of leaving the old ones in place. github.com
• Behavior changed
  Files loaded with the text loader no longer keep a leading UTF-8 BOM in the string. Code depending on the \uFEFF prefix must change. github.com
• Behavior changed
  With legal comment external or linked modes, the .LEGAL.txt file is only written when it has content. Build tooling expecting that file always to exist must change. github.com
• Behavior changed
  The dev server no longer sends permissive CORS headers and rejects requests whose host does not match the one given to --serve. Code relying on cross-origin access must use a proxy in front of esbuild. github.com
• Signature changed Port
  The Port option in the Go API is now an int, and -1 selects a random port. Go code using uint16 values or port 0 must be updated. github.com
• Signature changed serve
  The serve() call now returns a hosts array rather than a host string. Code reading the host property must read hosts instead. github.com

0.24.1

2 breaking changes, first published December 20, 2024.

• Behavior changed
  Sources that produce an empty source map can now emit a null mapping, which changes source map contents. Most users should not be affected, but source mapped stack traces may differ. github.com
• Behavior changed
  When the entry point is named index.js and its parent directory equals outbase, esbuild now uses 'index' instead of the directory name when naming generated variables, so bundle output text changes. github.com

0.24.0

2 breaking changes, first published September 22, 2024.

• Removed
  Go 1.23 requires macOS 11 Big Sur or later, so the published esbuild binaries no longer support macOS 10.15. To run on that version, compile esbuild from source with a Go version older than 1.23. github.com
• Behavior changed
  With useDefineForClassFields set to false and standard decorators, esbuild now initializes fields that have no initializer, matching TypeScript. Code that relied on those fields being omitted may behave differently. github.com

0.23.0

1 breaking change, first published July 2, 2024.

• Default changed --packages
  With --platform=node, the default is --packages=bundle again instead of the external default from 0.22.0. Set --packages=external explicitly if you need dependencies left out of the bundle. github.com

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.