●Change8

Migrating to esbuild v0.28.1

Version v0.28.1 introduces 1 breaking change. This guide details how to update your code.

Released: 6/11/2026

1
Breaking Changes
2
Migration Steps
8
Affected Symbols

⚠️ Check Your Code

If you use any of these symbols, you need to read this guide:

esbuild local development serveresbuild Deno API`using` declaration minification`await using` declaration minificationmodule evaluation error handling`new` operator expression parsingnested `var` declaration hoistingTypeScript `import x = require('y')` transformation for ES5 target

Breaking Changes

●Issue #1

HTTP requests to esbuild's local development server containing \\ backslash characters are now disallowed on Windows to fix a path traversal security vulnerability. Users relying on \\ in paths must switch to /.

Migration Steps

  1. 1
    If using the local development server on Windows, ensure HTTP request paths use forward slashes (/) instead of backslashes (\) for path traversal.
  2. 2
    If overriding the package registry for the Deno API via `NPM_CONFIG_REGISTRY`, ensure the custom registry serves an esbuild executable matching the expected content hash.

Release Summary

This release patches two security vulnerabilities related to path traversal in the dev server and integrity checks in the Deno API. It also includes several bug fixes addressing minification issues, module evaluation errors, and incorrect code generation for `new` expressions.

Need More Details?

View the full release notes and all changes for esbuild v0.28.1.

View Full Changelog