Explicit esbuild dependency blocks fallback to esbuild-wasm

[minijus]

Describe the bug

vite adds esbuild as explicit dependency: https://github.com/vitejs/vite/blob/main/packages/vite/package.json#L69
In some environments esbuild executable can be blocked (due to security or other reasons) and not having proper fallback to esbuild-wasm blocks any development there.

We noticed the issue after upgrading to latest version of Angular which adds vite as a dependency. Angular itself solves this by adding esbuild-wasm as a dependency and esbuild as a optionalDependency. This allows using esbuild on environements where executable is not blocked and successfully fallbacks to esbuild-wasm where original executable is blocked - https://github.com/angular/angular-cli/blob/419cc8282ecc8a06dfe5d66aacf29ee50da2cf80/packages/angular_devkit/build_angular/package.json#L75

Would it be possible to add similar dependency setup for vite as well?

Related issues on angular-cli and jest-preset-angular:

• Blocked esbuild.exe executable breaks Angular projects angular/angular-cli#21687
• [Bug]: Doesn't fallback to esbuild-wasm for systems without esbuild.exe thymikee/jest-preset-angular#1255

Reproduction

https://github.com/minijus/vite-esbuild-repro

Steps to reproduce

Repository with "reproduction" contains two Angular workspaces, with v15 and v16.

v15 does not have vite as a dependency and transitive esbuild dependency from Angular is always optional.
v16 has vite as a transitive dependency and in this setup esbuild becomes standard dependency with no possibility to fallback to esbuild-wasm.

System Info

There is nothing specific about environment details that impact the issue. Issue originates on restricted environments that block `esbuild` executable.

Used Package Manager

npm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[bluwy]

I think this should be fixed or handled on Angular side. We've been using a direct esbuild dependency without issues, and if you need to use esbuild-wasm, you can override that at the package manager level, e.g. npm overrides. Perhaps this setting could be setup automatically or documented by Angular?

"overrides": {
  "esbuild": "npm:esbuild-wasm@latest"
}

[minijus]

The issue with overrides is that it will force esbuild-wasm for all environments, including ones that allow standard esbuild binaries. Adding override will result in changes package-lock.json and this change will reflect on all environments (including ones that allow running standard esbuild binaries).

In our case, Windows require signing esbuild binary till it is allowed to be run on machines and esbuild-wasm runs without that, so it is great to have working fallback to esbuild-wasm, but not as a default, since Linux/Mac are using standard esbuild binaries.

I do not think Angular can have a "fix" here, since the issue happens on install (npm ci) phase, because esbuild is direct dependency of vite.

[bluwy]

overrides forcing esbuild-wasm on all environments sounds like a fair tradeoff if your organization has that restriction. Vite is also planning to use more native binary packages in the future (without wasm alternatives) so the proposed solution isn't really a feasible.

[minijus]

Native packages as long as they are signed is not an issue - they can be excluded from AppLocker using signing details.
Sadly, esbuild did not plan to work on adding binary signing: evanw/esbuild#1561

Adding overrides is a working workaround (with performance penalties), but it could not be needed if libraries adopt esbuild as optional dependency with fallback to esbuild-wasm when it is not available.

[bluwy]

I don't think we will be supporting this. We have already started using more binaries, e.g. from Rollup 4 and there's no plans for this setup.