Version Details and Security Vulnerabilities

📦

tsup

8.5.0

Comparision Betweeen 8.5.0 and 8.4.0

Identify the differences between the current version of the package and the previous one.

Version

Dependencies

Dev Dependencies

Peer Dependencies

Distributed Files

Unpacked Size

380.62 KB

380.38 KB

Version 8.5.0 Details

Tsup 8.5.0 introduces some notable changes compared to the previous stable version, 8.4.0, primarily revolving around dependency management within this zero-config TypeScript bundler powered by esbuild. While both versions share a core set of dependencies crucial for their functionality — including esbuild, rollup, and sucrase for efficient bundling and transformation, and tools like cac, consola and debug for CLI argument parsing, logging and debugging — version 8.5.0 makes a relevant fix by adding fix-dts-default-cjs-exports as dependency. This dependency likely addresses challenges related to the correct handling of default exports in CommonJS modules when generating TypeScript definition files, which can improve interoperability with different JavaScript environments.

In the *devDependencies*, both versions use a comprehensive suite of tools for development, testing, and building features. This included testing frameworks like vitest with tools like @swc/core for speed, while type-checking improvements make use of typescript version 5.7.3, alongside utilities like ts-essentials offering utilities for better quality and types. The package also contains things like prettier, sass, rollup-plugin-dts, svelte and svelte-preprocess to deliver the maximum experience to the user.

Both versions list similar peer dependencies such as postcss, typescript, @swc/core, and @microsoft/api-extractor. This indicates a consistent external API and integration points for developers using tsup to bundle their libraries, ensuring compatibility with common tools in the TypeScript ecosystem. Overall, upgrading to version 8.5.0 provides developers with stability and better quality by resolving previous issues.

Security Vulnerabilities

This site is an independent open-source project and is not affiliated with, endorsed by, or sponsored by npm, Inc. or GitHub, Inc. The name “npm” is a registered trademark of npm, Inc., used here solely to describe compatibility and reference publicly available npm package data.