Release v137 (#1312)

Author: ije

CHANGELOG-CLI.md

@@ -0,0 +1,53 @@
+# CLI Changelog
+
+## v0.1.0
+
+Introduce `esm.sh` CLI, a _no-build_ tool for modern web development. Features include:
+
+- Initialize a new no-build web app with esm.sh CDN
+- Serve web apps with esm.sh CDN, HMR, transforming TS/Vue/Svelte on the fly
+- Maintain the `importmap` script in index.html
+
+## Installation
+
+Install `esm.sh` CLI via curl:
+
+```bash
+curl -fsSL https://esm.sh/install | bash
+```
+
+To install `esm.sh` CLI from source code, you need to have [Go](https://go.dev/dl) installed.
+
+```bash
+go install github.com/esm-dev/esm.sh
+```
+
+Or install `esm.sh` CLI via `npm`:
+
+```bash
+npm install -g esm.sh
+```
+
+Or use `npx esm.sh` without installation:
+
+```bash
+npx esm.sh [command]
+```
+
+### Usage
+
+```
+$ esm.sh --help
+Usage: esm.sh [command] [options]
+
+Commands:
+  add [...imports]      Add imports to the "importmap" script in index.html
+  tidy                  Clean up and optimize the "importmap" script in index.html
+  init                  Initialize a new no-build web app
+  serve                 Serve the web app in "production" mode
+  dev                   Serve the web app in "development" mode with live reload
+
+Options:
+  --version, -v         Show the version
+  --help, -h            Display this help message
+```

CHANGELOG.md CHANGELOG-SERVER.mdCHANGELOG.md renamed to CHANGELOG-SERVER.md

@@ -1,4 +1,54 @@
-# Changelog
+# Server Changelog
+
+## v137
+
+* Introduce `esm.sh/x` - ts/jsx/vue/svelte just works™️ in browser.
+  ```html
+  <!-- use build tools like Vite, Webpack, etc. -->
+  <script type="module" src="app.tsx"></script>
+
+  <!-- use esm.sh/x without build tools -->
+  <script src="https://esm.sh/x" href="app.tsx"></script>
+  ```
+* Introduce date(`yyyy-mm-dd`) versioning
+  ```js
+  import * as myPackage from "https://esm.sh/my-package@2026-01-02";
+  ```
+* Introduce `?meta` API that allows you to get the module build metadata.
+  ```
+  $ curl https://esm.sh/react?meta
+  {
+    "name": "react",
+    "version": "19.2.4",
+    "module": "/react@19.2.4/es2022/react.mjs",
+    "integrity": "sha384-xPv1wRGmRBj4tIrN16FDkSIeMntFCfG+8ptsnx5wqrM+0zp/oKtoyJ0QqCJAAeVm",
+    "dts": "/@types/react@~19.2.9/index.d.ts",
+    "exports": ["./jsx-runtime", "./jsx-dev-runtime", "./compiler-runtime"],
+  }
+  ```
+* Other Changes:
+  * Upgrade `esbuild` to 0.27.3
+  * Upgrade `unenv` to 2.0.0-rc.22
+  * Support import with `{ type: "json" }` (#1202)
+  * Support import with `{ type: "css" }` (#1193)
+  * Support `.d.cts` types (#987)
+  * Support namespace-based external marking (#1188)
+  * Optimize storage (#1260)
+  * Remove unsafe `x-zone-id` and `x-npmrc` headers (#1235)
+  * Ban urls with `/../` segments in path (#1271)
+  * Reserve semantic version of dependencies (#1313)
+  * Cache npm registry "not found" responses (#1297)
+  * Add `npmBackupRegistry` config for rate limitation (#1296)
+  * Fix sub-modules end with `.map` (#1311)
+  * Fix tree-shaking with exports query (#1310)
+  * Fix memory leak (#1157)
+  * Fix S3 Storage signature with `/#/` path (#1022)
+  * Fix forward build deps for Typescript types (#1244)
+  * Fix `pkg.pr.new` redirects (#1204)
+  * Fix SSRF (#1149)
+  * Fix `*.css?module` XSS (#1237)
+  * Fix dts_lexer: bufio.Scanner: token too long (#1139)
+  * Fix cjs-module-lexer timeout (#1265)
 
 ## v136
 

Dockerfile

@@ -1,4 +1,5 @@
-FROM golang:1.25-alpine AS builder
+# build >>>
+FROM golang:1.26-alpine AS builder
 
 ARG SERVER_VERSION="main"
 
@@ -7,16 +8,17 @@ RUN git clone --branch $SERVER_VERSION --depth 1 https://github.com/esm-dev/esm.
 
 WORKDIR /tmp/esm.sh
 RUN go build -ldflags="-s -w -X 'github.com/esm-dev/esm.sh/server.VERSION=${SERVER_VERSION}'" -o esmd server/esmd/main.go
+# <<< build
 
 FROM alpine:latest
 
 RUN apk update && apk add --no-cache git
 RUN addgroup -g 1000 esm && adduser -u 1000 --home=/esm -G esm -D esm
 
 COPY --from=builder /tmp/esm.sh/esmd /bin/esmd
-COPY --from=denoland/deno:bin-2.5.6 --chown=esm:esm /deno /esm/bin/deno
+COPY --from=denoland/deno:bin-2.6.9 --chown=esm:esm /deno /esm/bin/deno
 
-# deno desn't provider musl build yet, the hack below makes the gnu build working in alpine
+# deno doesn't provide musl build yet, the hack below makes the gnu build working in alpine
 # see https://github.com/denoland/deno_docker/blob/main/alpine.dockerfile
 COPY --from=gcr.io/distroless/cc --chown=root:root --chmod=755 /lib/*-linux-gnu/* /usr/local/lib/
 COPY --from=gcr.io/distroless/cc --chown=root:root --chmod=755 /lib/ld-linux-* /lib/

HOSTING.md

@@ -61,7 +61,7 @@ esm.sh provides a Docker image for fast deployment. You can pull the container i
 
 ```bash
 docker pull ghcr.io/esm-dev/esm.sh        # latest stable version
-docker pull ghcr.io/esm-dev/esm.sh:v136_1 # specific stable version
+docker pull ghcr.io/esm-dev/esm.sh:v137   # specified stable version
 docker pull ghcr.io/esm-dev/esm.sh:dev    # latest dev version
 ```
 

Makefile

@@ -8,10 +8,10 @@ run/cli/tidy:
 	@go run -tags debug main.go tidy
 
 run/cli/dev:
-	@go run -tags debug main.go dev ${args} cli/template/${app}
+	@go run -tags debug main.go dev ${args} cli/templates/${app}
 
 run/cli/serve:
-	@go run -tags debug main.go serve ${args} cli/template/${app}
+	@go run -tags debug main.go serve ${args} cli/templates/${app}
 
 run/server: config.json
 	@rm -rf .esmd/log

README.md

@@ -301,41 +301,6 @@ you to use query params with trailing slash: change the query prefix `?` to `&`
 }
 ```
 
-## Using `esm.sh/tsx`
-
-`esm.sh/tsx` is a lightweight **1KB** script that allows you to write `TSX` directly in HTML without any build steps. Your source code is sent to the server, compiled, cached at the edge, and served to the browser as a JavaScript module.
-
-`esm.sh/tsx` supports `<script>` tags with `type` set to `text/babel`, `text/jsx`, `text/ts`, or `text/tsx`.
-
-In development mode (open the page on localhost), `esm.sh/tsx` uses [@esm.sh/tsx](https://github.com/esm-dev/tsx) to transform JSX syntax into JavaScript.
-
-```html
-<!DOCTYPE html>
-<html>
-<head>
-  <script type="importmap">
-    {
-      "imports": {
-        "react": "https://esm.sh/react@19.2.0",
-        "react-dom/client": "https://esm.sh/react-dom@19.2.0/client"
-      }
-    }
-  </script>
-  <script type="module" src="https://esm.sh/tsx"></script>
-</head>
-<body>
-  <div id="root"></div>
-  <script type="text/babel">
-    import { createRoot } from "react-dom/client"
-    createRoot(root).render(<h1>Hello, World!</h1>)
-  </script>
-</body>
-</html>
-```
-
-> [!TIP]
-> By default, esm.sh transforms your JSX syntax with `jsxImportSource` set to `react` or `preact` which is specified in the `importmap`. To use a custom JSX runtime, add `@jsxRuntime` specifier in the `importmap` script. For example, [solid-js](https://esm.sh/solid-js/jsx-runtime).
-
 ## Escape Hatch: Raw Source Files
 
 By default, esm.sh transforms (and bundles if necessary) the JavaScript source code. However, in rare cases, you may want to request JS source files from packages, as-is, without transformation into ES modules. To do so, you need to add a `?raw` query to the request URL.

cli/README.md

@@ -1,25 +1,32 @@
 # esm.sh CLI
 
-> [!WARNING]
-> The `esm.sh` CLI is still in development. Use it at your own risk.
+A _no-build_ tool for modern web development. Features include:
 
-A _nobuild_ tool for modern web development.
+- Initialize a new no-build web app with esm.sh CDN
+- Serve web apps with esm.sh CDN, HMR, transforming TS/Vue/Svelte on the fly
+- Maintain the `importmap` script in index.html
 
 ## Installation
 
-You can install `esm.sh` CLI from source code:
+Install `esm.sh` CLI via curl:
+
+```bash
+curl -fsSL https://esm.sh/install | bash
+```
+
+To install `esm.sh` CLI from source code, you need to have [Go](https://go.dev/dl) installed.
 
 ```bash
 go install github.com/esm-dev/esm.sh
 ```
 
-You can also install `esm.sh` CLI via `npm`:
+Or install `esm.sh` CLI via `npm`:
 
 ```bash
 npm install -g esm.sh
 ```
 
-Or use `npx` without installation:
+Or use `npx esm.sh` without installation:
 
 ```bash
 npx esm.sh [command]
@@ -29,16 +36,16 @@ npx esm.sh [command]
 
 ```
 $ esm.sh --help
-Usage: esm.sh [command] <options>
+Usage: esm.sh [command] [options]
 
 Commands:
-  add, i [...packages]    Add specified packages to the "importmap" script in index.html
-  update                  Update existing packages in the "importmap" script in index.html
-  tidy                    Clean up and optimize the "importmap" script in index.html
-  init                    Initialize a new web application
-  serve                   Serve the web application in production mode
-  dev                     Serve the web application in development mode with live reload
+  add [...imports]      Add imports to the "importmap" script in index.html
+  tidy                  Clean up and optimize the "importmap" script in index.html
+  init                  Initialize a new no-build web app
+  serve                 Serve the web app in "production" mode
+  dev                   Serve the web app in "development" mode with live reload
 
 Options:
-  --help                  Display this help message
+  --version, -v         Show the version
+  --help, -h            Display this help message
 ```

cli/cli.go

@@ -5,14 +5,14 @@ import (
 	"os"
 )
 
-const helpMessage = "\033[30mesm.sh - A nobuild tool for modern web development.\033[0m" + `
+const helpMessage = "\033[30mesm.sh - A no-build tool for modern web development.\033[0m" + `
 
 Usage: esm.sh [command] [options]
 
 Commands:
-  add [...packages]     Add specified packages to the "importmap" in index.html
-  tidy                  Clean up and optimize the "importmap" in index.html
-  init                  Initialize a new nobuild web app
+  add [...imports]      Add imports to the "importmap" script in index.html
+  tidy                  Clean up and optimize the "importmap" script in index.html
+  init                  Initialize a new no-build web app
   serve                 Serve the web app in "production" mode
   dev                   Serve the web app in "development" mode with live reload
 
@@ -34,9 +34,9 @@ func Run() {
 	case "init":
 		Init()
 	case "serve":
-		Serve(false)
+		Serve()
 	case "dev":
-		Serve(true)
+		Dev()
 	case "version":
 		fmt.Println("esm.sh CLI " + VERSION)
 	default:

cli/add.go cli/command_add.gocli/add.go renamed to cli/command_add.go

@@ -452,6 +452,7 @@ func (ui *subModuleSelectUI) clearLines() {
 			term.ClearLine()
 			os.Stdout.Write(EOL) // move to the next line
 		}
+		term.ClearLine()
 		term.MoveCursorUp(height)
 	}()
 }

cli/command_dev.go

@@ -0,0 +1,6 @@
+package cli
+
+// Dev serves a web app in development mode.
+func Dev() {
+	serve(true)
+}