Context
wrapito builds with tsup (esbuild) and tests with Vitest (esbuild transforms). The shared esbuild-based toolchain carries known advisories (esbuild, glob, minimatch, brace-expansion) that surface in npm audit and aren't trivially fixable without changing the tooling. All are devDependencies, so the published library is not affected at runtime.
Proposal
Evaluate moving to an SWC-based toolchain (Rust, no esbuild) for faster, lower-footprint builds and tests:
- Vitest transforms: replace esbuild with
unplugin-swc.
- Bundling: assess Rollup +
@rollup/plugin-swc (or rolldown) as a tsup alternative, keeping tsc for .d.ts emission and @arethetypeswrong/cli checks intact.
Trade-offs
- More explicit build config than tsup (SWC doesn't bundle by itself).
- Low urgency — dev-only advisories, DX/tech-debt improvement rather than a runtime security issue.
Acceptance criteria
Additional context: tsup is no longer maintained
tsup's own README now carries this notice:
Warning — This project is not actively maintained anymore. Please consider using tsdown instead. Read more in the migration guide.
So this isn't just an optimization — staying on tsup means depending on an unmaintained bundler. tsdown (Rust-based, Rolldown + Oxc) is the maintainer-recommended successor and should be the primary bundling target to evaluate alongside the SWC transform options above.
Context
wrapitobuilds with tsup (esbuild) and tests with Vitest (esbuild transforms). The shared esbuild-based toolchain carries known advisories (esbuild,glob,minimatch,brace-expansion) that surface innpm auditand aren't trivially fixable without changing the tooling. All aredevDependencies, so the published library is not affected at runtime.Proposal
Evaluate moving to an SWC-based toolchain (Rust, no esbuild) for faster, lower-footprint builds and tests:
unplugin-swc.@rollup/plugin-swc(orrolldown) as a tsup alternative, keepingtscfor.d.tsemission and@arethetypeswrong/clichecks intact.Trade-offs
Acceptance criteria
npm auditdelta, exports check still green)Additional context: tsup is no longer maintained
tsup's own README now carries this notice:
So this isn't just an optimization — staying on tsup means depending on an unmaintained bundler.
tsdown(Rust-based, Rolldown + Oxc) is the maintainer-recommended successor and should be the primary bundling target to evaluate alongside the SWC transform options above.