--- title: "esbuild Breaking Changes on npm | Since.dev" description: "What each esbuild release removed, renamed or changed: 43 breaking changes in 18 versions on npm, each with its source." canonical_url: https://since.dev/packages/npm/esbuild last_updated: 2026-06-11 --- # esbuild breaking changes Every breaking API change we have recorded in esbuild on npm: 43 breaking changes in 18 versions. Below are its newest 6 versions, removals and renames first, each with its source. Newest change June 11, 2026 ## 0.28.1 2 breaking changes, first published June 11, 2026. - **Behavior changed** Requests to the local development server whose paths contain a backslash are no longer allowed, as part of a fix for a path traversal issue on Windows. Code that relies on such requests must use forward slashes instead. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.28.1) - **Behavior changed** The Deno API now checks the integrity of the downloaded esbuild binary and errors on a mismatch. A custom registry set through NPM_CONFIG_REGISTRY must serve the expected executable content. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.28.1) ## 0.28.0 1 breaking change, first published April 2, 2026. - **Behavior changed** If esbuild's platform package install fails and the fallback download runs, the downloaded binary is now checked against an embedded hash. Downloads that do not match will fail, and the release is marked as breaking. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.28.0) ## 0.25.0 9 breaking changes, first published February 8, 2025. - **Removed** `ServeResult.host` ServeResult.host was removed in esbuild 0.25.0 [npmjs.com](https://www.npmjs.com/package/esbuild/v/0.25.0) - **Behavior changed** Console dropping now replaces only one level of method call, so console.log.bind(console) keeps working. Code relying on deeper console calls being removed must change. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.25.0) - **Behavior changed** A port of 0 in the CLI and JS API now asks the OS for a random ephemeral port rather than defaulting to 8000. Use -1 in the Go API for a random port. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.25.0) - **Behavior changed** If a rebuild fails in watch mode, esbuild now deletes all output files instead of leaving the old ones in place. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.25.0) - **Behavior changed** Files loaded with the text loader no longer keep a leading UTF-8 BOM in the string. Code depending on the \\uFEFF prefix must change. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.25.0) - **Behavior changed** With legal comment external or linked modes, the .LEGAL.txt file is only written when it has content. Build tooling expecting that file always to exist must change. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.25.0) - **Behavior changed** The dev server no longer sends permissive CORS headers and rejects requests whose host does not match the one given to --serve. Code relying on cross-origin access must use a proxy in front of esbuild. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.25.0) - **Signature changed** `Port` The Port option in the Go API is now an int, and -1 selects a random port. Go code using uint16 values or port 0 must be updated. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.25.0) - **Signature changed** `serve` The serve() call now returns a hosts array rather than a host string. Code reading the host property must read hosts instead. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.25.0) ## 0.24.1 2 breaking changes, first published December 20, 2024. - **Behavior changed** Sources that produce an empty source map can now emit a null mapping, which changes source map contents. Most users should not be affected, but source mapped stack traces may differ. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.24.1) - **Behavior changed** When the entry point is named index.js and its parent directory equals outbase, esbuild now uses 'index' instead of the directory name when naming generated variables, so bundle output text changes. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.24.1) ## 0.24.0 2 breaking changes, first published September 22, 2024. - **Removed** Go 1.23 requires macOS 11 Big Sur or later, so the published esbuild binaries no longer support macOS 10.15. To run on that version, compile esbuild from source with a Go version older than 1.23. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.24.0) - **Behavior changed** With useDefineForClassFields set to false and standard decorators, esbuild now initializes fields that have no initializer, matching TypeScript. Code that relied on those fields being omitted may behave differently. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.24.0) ## 0.23.0 1 breaking change, first published July 2, 2024. - **Default changed** `--packages` With --platform=node, the default is --packages=bundle again instead of the external default from 0.22.0. Set --packages=external explicitly if you need dependencies left out of the bundle. [github.com](https://github.com/evanw/esbuild/releases/tag/v0.23.0) ## Check your code These are the changes. To see which of them reach your code, [scan a public repository](https://since.dev/scan.md), or have your coding agent call `check_code` with your manifest or lockfile over [MCP](https://since.dev/docs.md#mcp). [The API](https://since.dev/docs.md#api) reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys. ## Put your code on continuous management. Scan a public repository now, or give your agent one line. ### See how out of date your code is. [Scan a repository](https://since.dev/scan.md). Any public GitHub repository. No sign-in. ### Tell your agent what changed since it was trained. `claude mcp add --transport http since https://api.since.dev/mcp` --- Every page on this site as Markdown: https://since.dev/sitemap.md. For agents: https://since.dev/llms.txt.