Replace esbuild with Vite and Rolldown APIs

.changeset/create-astro-allow-scripts.md

@@ -0,0 +1,5 @@
+---
+'create-astro': patch
+---
+
+Removes the automatic `allowScripts` and `allowBuilds` pre-approval from generated projects. Astro's dependencies no longer run install scripts, so the workaround is no longer needed.

.changeset/rolldown-internal-bundling.md

@@ -0,0 +1,9 @@
+---
+'astro': patch
+'@astrojs/netlify': patch
+'@astrojs/vercel': patch
+'@astrojs/markdoc': patch
+'astro-vscode': patch
+---
+
+Refactors internal bundling and code transforms to use Vite's Oxc-based `transformWithOxc` and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

.github/renovate.json5

@@ -217,8 +217,7 @@
     "deno",
 
     // follow vite deps version
-    "postcss-load-config",
-    "esbuild"
+    "postcss-load-config"
   ],
   "minimumReleaseAge": "3 days"
 }

.github/scripts/bundle-size.mjs

@@ -1,5 +1,5 @@
 import { existsSync } from 'node:fs';
-import { build } from 'esbuild';
+import { rolldown } from 'rolldown';
 
 const CLIENT_RUNTIME_PATH = 'packages/astro/src/runtime/client/';
 
@@ -67,36 +67,53 @@ ${table.join('\n')}`,
 }
 
 async function bundle(files) {
-	const { metafile } = await build({
-		entryPoints: [
-			...files.map(({ filename }) => filename),
-			...files.map(({ filename }) => `main/${filename}`).filter((f) => existsSync(f)),
-		],
-		bundle: true,
-		minify: true,
-		sourcemap: false,
-		target: ['esnext'],
-		outdir: 'out',
-		external: ['astro:*', 'aria-query', 'axobject-query'],
-		metafile: true,
-	});
+	const entryPoints = [
+		...files.map(({ filename }) => filename),
+		...files.map(({ filename }) => `main/${filename}`).filter((f) => existsSync(f)),
+	];
+
+	const sizes = {};
+	for (const entryPoint of entryPoints) {
+		const isOld = entryPoint.startsWith('main/');
+		const name = entryPoint.replace(/\.[^.]+$/, '');
+		const bundle = await rolldown({
+			input: { [name]: entryPoint },
+			platform: 'browser',
+			external: (id) =>
+				id.startsWith('astro:') ||
+				id === 'aria-query' ||
+				id.startsWith('aria-query/') ||
+				id === 'axobject-query' ||
+				id.startsWith('axobject-query/'),
+			transform: { target: 'esnext' },
+		});
 
-	return Object.entries(metafile.outputs).reduce((acc, [filename, info]) => {
-		filename = filename.slice('out/'.length);
-		if (filename.startsWith('main/')) {
-			filename = filename.slice('main/'.length).replace(CLIENT_RUNTIME_PATH, '').replace('.js', '');
-			const oldSize = info.bytes;
-			return Object.assign(acc, {
-				[filename]: Object.assign(acc[filename] ?? { oldSize: 0, newSize: 0 }, { oldSize }),
+		try {
+			const { output } = await bundle.generate({
+				format: 'esm',
+				minify: true,
+				codeSplitting: false,
+				entryFileNames: '[name].js',
 			});
+			const chunk = output.find((item) => item.type === 'chunk');
+			if (!chunk) continue;
+
+			const filename = entryPoint
+				.replace(/^main\//, '')
+				.replace(CLIENT_RUNTIME_PATH, '')
+				.replace(/\.[^.]+$/, '');
+			const size = Buffer.byteLength(chunk.code);
+			const entry = (sizes[filename] ??= { oldSize: 0, newSize: 0 });
+			if (isOld) {
+				entry.oldSize = size;
+			} else {
+				entry.newSize = size;
+				entry.sourceFile = entryPoint;
+			}
+		} finally {
+			await bundle.close();
 		}
-		filename = filename.replace(CLIENT_RUNTIME_PATH, '').replace('.js', '');
-		const newSize = info.bytes;
-		return Object.assign(acc, {
-			[filename]: Object.assign(acc[filename] ?? { oldSize: 0, newSize: 0 }, {
-				newSize,
-				sourceFile: Object.keys(info.inputs).find((src) => src.endsWith('.ts')),
-			}),
-		});
-	}, {});
+	}
+
+	return sizes;
 }

AGENTS.md

@@ -162,4 +162,4 @@ When writing unit tests, read [`reference/unit-testing.md`](./reference/unit-tes
 
 ## Vite Dep Optimizer (`optimizeDeps`)
 
-When a bug works in `astro build` but fails in `astro dev` with errors like `require is not defined`, the root cause is almost always Vite's dep optimizer failing to pre-bundle a CJS dependency. `astro build` uses Rollup and handles CJS→ESM reliably; `astro dev` relies on esbuild's optimizer scan, which is intentionally shallow and will miss deps that are only reachable through non-JS files (like `.astro` components in `node_modules`). The key files are `packages/astro/src/vite-plugin-environment/index.ts` (sets `optimizeDeps.entries`) and `packages/astro/src/core/create-vite.ts` (wires up `vitefu`/`crawlFrameworkPkgs`). For a full deep-dive including a debugging playbook and potential fixes, see [`reference/optimize-deps.md`](./reference/optimize-deps.md).
+When a bug works in `astro build` but fails in `astro dev` with errors like `require is not defined`, the root cause is almost always Vite's dep optimizer failing to pre-bundle a CJS dependency. `astro build` uses Vite's Rolldown-based build and handles CJS→ESM reliably. `astro dev` relies on Rolldown's optimizer scan, which is intentionally shallow and will miss deps that are only reachable through non-JS files (like `.astro` components in `node_modules`). The key files are `packages/astro/src/vite-plugin-environment/index.ts` (sets `optimizeDeps.entries`) and `packages/astro/src/core/create-vite.ts` (wires up `vitefu`/`crawlFrameworkPkgs`). For a full deep-dive including a debugging playbook and potential fixes, see [`reference/optimize-deps.md`](./reference/optimize-deps.md).

examples/advanced-routing/package.json

@@ -16,8 +16,5 @@
     "@astrojs/node": "^11.1.7",
     "astro": "^7.3.7",
     "hono": "^4.13.11"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/basics/package.json

@@ -14,8 +14,5 @@
   },
   "dependencies": {
     "astro": "^7.3.7"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/blog/package.json

@@ -18,8 +18,5 @@
     "@astrojs/sitemap": "^3.7.4",
     "astro": "^7.3.7",
     "sharp": "^0.35.0"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/component/package.json

@@ -22,8 +22,5 @@
   },
   "peerDependencies": {
     "astro": "^5.0.0 || ^6.0.0"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/container-with-vitest/package.json

@@ -23,8 +23,5 @@
   "devDependencies": {
     "@types/react": "^18.3.31",
     "@types/react-dom": "^18.3.7"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/framework-alpine/package.json

@@ -17,8 +17,5 @@
     "@types/alpinejs": "^3.17.0",
     "alpinejs": "^3.17.4",
     "astro": "^7.3.7"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/framework-multiple/package.json

@@ -27,8 +27,5 @@
     "solid-js": "^1.9.15",
     "svelte": "^5.57.1",
     "vue": "^3.5.43"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/framework-preact/package.json

@@ -17,8 +17,5 @@
     "@preact/signals": "^2.11.2",
     "astro": "^7.3.7",
     "preact": "^10.29.8"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/framework-react/package.json

@@ -19,8 +19,5 @@
     "astro": "^7.3.7",
     "react": "^18.3.1",
     "react-dom": "^18.3.1"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/framework-solid/package.json

@@ -16,8 +16,5 @@
     "@astrojs/solid-js": "^7.0.2",
     "astro": "^7.3.7",
     "solid-js": "^1.9.15"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/framework-svelte/package.json

@@ -16,8 +16,5 @@
     "@astrojs/svelte": "^9.0.1",
     "astro": "^7.3.7",
     "svelte": "^5.57.1"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/framework-vue/package.json

@@ -16,8 +16,5 @@
     "@astrojs/vue": "^7.0.3",
     "astro": "^7.3.7",
     "vue": "^3.5.43"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/hackernews/package.json

@@ -15,8 +15,5 @@
   "dependencies": {
     "@astrojs/node": "^11.1.7",
     "astro": "^7.3.7"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/integration/package.json

@@ -22,8 +22,5 @@
   },
   "peerDependencies": {
     "astro": "^4.0.0"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/minimal/package.json

@@ -14,8 +14,5 @@
   },
   "dependencies": {
     "astro": "^7.3.7"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/portfolio/package.json

@@ -14,8 +14,5 @@
   },
   "dependencies": {
     "astro": "^7.3.7"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/ssr/package.json

@@ -18,8 +18,5 @@
     "@astrojs/svelte": "^9.0.1",
     "astro": "^7.3.7",
     "svelte": "^5.57.1"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/starlog/package.json

@@ -15,8 +15,5 @@
   },
   "engines": {
     "node": ">=22.12.0"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/toolbar-app/package.json

@@ -20,8 +20,5 @@
   },
   "engines": {
     "node": ">=22.12.0"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/with-markdoc/package.json

@@ -15,8 +15,5 @@
   "dependencies": {
     "@astrojs/markdoc": "^2.0.10",
     "astro": "^7.3.7"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/with-mdx/package.json

@@ -17,8 +17,5 @@
     "@astrojs/preact": "^6.0.6",
     "astro": "^7.3.7",
     "preact": "^10.29.8"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/with-nanostores/package.json

@@ -18,8 +18,5 @@
     "astro": "^7.3.7",
     "nanostores": "^1.5.4",
     "preact": "^10.29.8"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/with-tailwindcss/package.json

@@ -20,8 +20,5 @@
     "canvas-confetti": "^1.9.4",
     "tailwindcss": "^4.3.3",
     "vite": "^8.3.1"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

examples/with-vitest/package.json

@@ -16,8 +16,5 @@
   "dependencies": {
     "astro": "^7.3.7",
     "vitest": "^5.0.2"
-  },
-  "allowScripts": {
-    "esbuild": true
   }
 }

knip.js

@@ -37,6 +37,7 @@ export default {
 			ignoreDependencies: [
 				'@astrojs/check', // Used by the build script but not as a standard module import
 				'bgproc', // Used by agents, documented in the AGENTS.md file
+				'rolldown', // Used by the bundle-size GitHub Action script in `.github/scripts`
 			],
 			// In smoke tests, we checkout to the docs repo so those binaries are not present in this project
 			// vsce and ovsx are only used in CI for publishing, and due to how we have to publish the VS Code extension have
@@ -87,9 +88,6 @@ export default {
 				// Optional peer dep: dynamically imported in config validation for the legacy
 				// remark/rehype pipeline. Knip flags it because it's referenced from source.
 				'@astrojs/markdown-remark',
-				// Not imported directly: pins a minimum version of Vite's rolldown dependency
-				// (>=1.2.10 fixes WebContainers). Remove once Vite requires it.
-				'rolldown',
 			],
 		},
 		'packages/astro-prism': {

package.json

@@ -80,6 +80,7 @@
     "prettier": "^3.9.0",
     "prettier-plugin-astro": "^1.1.0",
     "publint": "^0.3.17",
+    "rolldown": "^1.2.11",
     "tinyglobby": "^0.2.16",
     "turbo": "^2.10.2",
     "typescript": "~6.0.3",

packages/astro/package.json

@@ -142,7 +142,6 @@
     "diff": "^9.0.0",
     "dset": "^3.1.4",
     "es-module-lexer": "^3.0.2",
-    "esbuild": "^0.28.0",
     "find-proc": "0.2.0",
     "flattie": "^1.1.1",
     "fontace": "~0.4.1",

packages/astro/src/cli/infra/build-time-astro-version-provider.ts

@@ -1,6 +1,6 @@
 import type { AstroVersionProvider } from '../definitions.js';
 
 export class BuildTimeAstroVersionProvider implements AstroVersionProvider {
-	// Injected during the build through esbuild define
+	// Injected during the build through rolldown define
 	readonly version: string = process.env.PACKAGE_VERSION ?? '';
 }