tsdown
“Bundle TypeScript and JavaScript libraries with blazing-fast speed powered by Rolldown. Use when building libraries, generating type declarations, bundling for multiple formats, or migrating from tsup.”
references
aipkg.jsonLICENSE.mdLICENSE.txtREADME.mdreferences/advanced-benchmark.mdreferences/advanced-ci.mdreferences/advanced-hooks.mdreferences/advanced-plugins.mdreferences/advanced-programmatic.mdreferences/advanced-rolldown-options.mdreferences/guide-getting-started.mdreferences/guide-introduction.mdreferences/guide-migrate-from-tsup.mdreferences/option-cjs-default.mdreferences/option-cleaning.mdreferences/option-config-file.mdreferences/option-css.mdreferences/option-dependencies.mdreferences/option-dts.mdreferences/option-entry.mdreferences/option-exe.mdreferences/option-lint.mdreferences/option-log-level.mdreferences/option-minification.mdreferences/option-output-directory.mdreferences/option-output-format.mdreferences/option-package-exports.mdreferences/option-platform.mdreferences/option-root.mdreferences/option-shims.mdreferences/option-sourcemap.mdreferences/option-target.mdreferences/option-tree-shaking.mdreferences/option-unbundle.mdreferences/option-watch-mode.mdreferences/README.mdreferences/recipe-react.mdreferences/recipe-solid.mdreferences/recipe-svelte.mdreferences/recipe-vue.mdreferences/recipe-wasm.mdreferences/reference-cli.mdSKILL.mdSYNC.md- 01SQP-275%MEDIUM
references/option-minification.md:9
detailhide
The documentation mentions the Oxc minifier is 'currently in alpha' but does not adequately warn users about the risks of using alpha-stage code transformation tools in production. Alpha software can have critical bugs that silently corrupt or miscompile code, potentially introducing security vulnerabilities or breaking application functionality. Users may not realize they are using unstable software unless this is prominently highlighted.
07Minification removes unnecessary characters (whitespace, comments) and optimizes code for production, reducing bundle size and improving load times.0809**Note:** Uses [Oxc minifier](https://oxc.rs/docs/contribute/minifier) internally. The minifier is currently in alpha.1011## Typefix Add a prominent warning box early in the document (after the Overview section) explicitly cautioning users about alpha-stage minifier risks. Include: (1) Clear statement that Oxc minifier is unstable and may have bugs, (2) Recommendation to thoroughly test minified output before production deployment, (3) Suggestion to use 'dce-only' mode as a safer alternative, (4) Link to bug reporting if issues are encountered. Consider adding similar warnings in the Tips and Troubleshooting sections to ensure visibility.
- 02SQP-285%HIGH
references/option-watch-mode.md:55
detailhide
The documentation demonstrates the `--on-success` flag executing arbitrary shell commands (e.g., `node dist/index.mjs`, `npm run test`, `vitest run`) without warning users about the security implications. If a user executes a tsdown command with an untrusted `--on-success` parameter or config, arbitrary code can be executed in their development environment. This is particularly dangerous in CI/CD pipelines or shared development environments where config files might be modified by untrusted sources.
53```5455### On Success Command5657Run command after successful build:fix Add a prominent security warning section in the documentation explaining that `--on-success` commands execute with the same privileges as the tsdown process. Include examples of safe practices, recommend input validation if the command comes from external sources, and warn against using user-provided input directly in the `--on-success` flag. Consider adding a note about the risks in CI/CD environments specifically.