TL;DR

esbuild now prevents potential security vulnerabilities in its development server and Deno API by validating downloaded binaries, and includes several fixes to JavaScript code transformation, particularly around resource disposal and the new operator.

Breaking

• HTTP Request Restriction: Backslashes (\) are no longer allowed in URLs when using the local development server on Windows, addressing a potential path traversal vulnerability.
• Deno API Integrity: The Deno API now requires downloaded esbuild binaries to match expected content, potentially breaking custom registry configurations. (Package registries - online repositories for code)

Fixes Worth Knowing

• Module Evaluation: Errors during module import (import() or require()) are now consistently thrown on each attempt, improving error reporting.
• new Operator: Correctly handles complex expressions within the new operator, fixing syntax errors and ensuring correct behavior.
• var Declaration Renaming: Fixes issues with renaming var declarations in nested scopes, preventing potential name collisions.
• using and await using: Correctly handles resource disposal with these declarations, preventing memory leaks. (Resource disposal - releasing system resources)