Migrate production bundle to esbuild

[0bkevin]

Related to #420.

This migrates the root production bundle from webpack to esbuild, which was called out in the bounty thread as the first useful change to import/adapt.

Changes:

• replace the root webpack prepare step with node build.js
• preserve the existing browser process/Buffer injection
• preserve the viewer/lib/utils -> utils.web.js browser replacement
• preserve the minecraft-data pruning rules for the index and worker bundles
• remove the unused root webpack config/dependencies

Verification:

• npm run lint
• node build.js

Notes:

• A normal npm install failed locally before verification because the existing gl native dependency could not build on Node 24/macOS arm64 (python: command not found from the dependency build). I installed with --ignore-scripts to verify the JS changes.
• npm run prepare then fails locally at viewer/prerender.js because canvas native bindings are absent after the script-disabled install. The new esbuild step itself succeeds.
• npm run jestTest could not start because Puppeteer Chrome 127 is not installed in this local cache.

IssueHunt: https://oss.issuehunt.io/repos/271385423/issues/420

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	puppeteer@​22.15.0
	jest-puppeteer@​11.0.0
	jest@​29.7.0
	esbuild@​0.27.7
	minecraft-wrap@​1.7.0
	minecrafthawkeye@​1.3.9
	mineflayer-pathfinder@​2.4.5
	minecraft-assets@​1.17.0
	three.meshline@​1.4.0
	socket.io-client@​4.8.3
	socket.io@​4.8.3
	standard@​17.1.2
	fs-extra@​11.3.5
	three@​0.128.0
	mineflayer@​4.37.1

View full report

[0bkevin]

CI note: the lint job passed. The build matrix jobs currently fail before npm install/tests at the apt-get install step because the Ubuntu mirror returns 404 for libpng-dev_1.6.43-5ubuntu0.5_amd64.deb / libpng-tools; the log suggests running apt-get update or retrying. So the current matrix failures do not exercise this PR yet.

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[0bkevin]

Follow-up after rechecking the migration:

• Amended the branch to keep devDependencies ordered and to escape module names in the esbuild empty-module helper.
• Re-ran local verification: npm run lint and node build.js both pass.
• Compared bundle output with the original webpack config locally:
  • webpack: index.js ~1.15 MiB in ~3.1s, worker.js ~98.4 MiB in ~13s
  • esbuild: index.js ~1.1 MiB in ~63ms, worker.js ~87.3 MiB in ~745ms

Fresh CI lint passed on the amended commit. The build matrix is still failing before npm/tests at apt package fetch (libpng-dev / libpng-tools 404), same external setup issue as before.

[0bkevin]

Addressed the Socket form-data@2.3.3 alert by adding an npm overrides entry that forces form-data to the patched 4.x line.

Verification after the change:

• npm install --ignore-scripts
• npm ls form-data --all -> only form-data@4.0.5
• npm run lint
• node build.js