惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

V
V2EX - 技术
D
DataBreaches.Net
阮一峰的网络日志
阮一峰的网络日志
Recent Announcements
Recent Announcements
V
V2EX
Hugging Face - Blog
Hugging Face - Blog
T
The Exploit Database - CXSecurity.com
Simon Willison's Weblog
Simon Willison's Weblog
Cisco Talos Blog
Cisco Talos Blog
Microsoft Security Blog
Microsoft Security Blog
C
Cyber Attacks, Cyber Crime and Cyber Security
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
K
Kaspersky official blog
F
Fortinet All Blogs
GbyAI
GbyAI
Forbes - Security
Forbes - Security
The Cloudflare Blog
博客园 - 司徒正美
博客园_首页
量子位
Schneier on Security
Schneier on Security
G
GRAHAM CLULEY
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
P
Proofpoint News Feed
N
News | PayPal Newsroom
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
博客园 - 聂微东
T
Tor Project blog
V
Vulnerabilities – Threatpost
Y
Y Combinator Blog
Jina AI
Jina AI
Help Net Security
Help Net Security
T
Threat Research - Cisco Blogs
Recent Commits to openclaw:main
Recent Commits to openclaw:main
C
Cybersecurity and Infrastructure Security Agency CISA
Project Zero
Project Zero
N
News and Events Feed by Topic
I
Intezer
B
Blog
美团技术团队
C
CERT Recently Published Vulnerability Notes
NISL@THU
NISL@THU
L
LINUX DO - 最新话题
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
Blog — PlanetScale
Blog — PlanetScale
AWS News Blog
AWS News Blog
T
Tailwind CSS Blog
The Last Watchdog
The Last Watchdog
雷峰网
雷峰网
有赞技术团队
有赞技术团队

The Practical Developer

The Libuv Thread Pool Trap: Why Node.js Async APIs Stall Under Load Postgres Covering Indexes with INCLUDE: Eliminate Heap Fetches on Read-Heavy Workloads Postgres DISTINCT ON: The Fastest Way to Get the Latest Row Per Group Postgres Transaction Isolation: The Anomalies Your App Actually Faces in Production Linux TCP Tuning for Node.js Microservices: The Kernel Settings That Stop Silent Connection Drops Under Load Postgres HOT Updates and Fillfactor: Why Not All Writes Are Created Equal Database Connection Pool Leaks: Finding the Promise That Never Returns Its Seat Linux OOM Killer in Production: Why Your Node.js Containers Die Without a Stack Trace Postgres Materialized Views: Refresh Strategies That Do Not Lock Your Dashboards API Dependency Health Checks: Why /health Is Not Enough Authorization with Zanzibar Tuples: How Google Manages Permissions and How To Build the Same Check in Node.js Postgres Advisory Locks: The 20-Character Primitive That Replaces Redis for Coordination Dead Letter Queues: The Message Queue Pattern That Saves You at 2 a.m. File Descriptor Exhaustion: The Kernel Limit That Silently Drops Node.js Connections Graceful Degradation: The Pattern That Turns Total Outages into Partial Success PostgreSQL Full-Text Search: Dropping Elasticsearch for 90% of Use Cases S3 Presigned Multipart Uploads: Stop Your API Server from Being a File Upload Bottleneck MessagePack vs JSON: The Binary Serialization Switch That Cut Our Internal RPC Overhead by 40% DNS Caching in Node.js: The Silent Cause of Production Latency Spikes Reliable Cron Jobs: The Pattern That Stops Double Runs, Missed Executions, And The 2 AM Page GraphQL Query Complexity: Stop the OOM Query Before It Reaches Your Resolver Node.js Event Loop Lag: The Hidden Metric Behind Random Latency Spikes API Request Validation with Zod: The Schema That Catches Bad Input Before It Corrupts Your Database Load Shedding in Node.js: How to Reject Traffic Before You Drown Request Hedging: Cut Tail Latency In Half Without Overprovisioning Git Bisect: The Automated Binary Search That Finds Breaking Commits in Minutes Node.js Garbage Collection Tuning: Stop Letting V8 Pause Your Event Loop Node.js Server Timeouts: The Settings That Stop Slow Clients from Holding Sockets Hostage Postgres BRIN Indexes: The Time-Series Secret That Shrinks Indexes by 99% Event Sourcing with PostgreSQL: The Pragmatic 80% Solution Node.js Cluster Mode: Scaling the Event Loop Across CPU Cores Postgres Partial Indexes: Stopping Soft Deletes from Ruining Your Query Performance Request Coalescing with the Singleflight Pattern: Stop Drowning Your Database on Every Cache Miss The Bulkhead Pattern: Why One Slow Endpoint Should Not Drown Your Whole Service Node.js AsyncLocalStorage: End-to-End Request Context Without the Propagation Hell Postgres Deadlocks: Logging the Victim, Reproducing the Race, and Fixing the Lock Order Your Node.js HTTP Client Is the Bottleneck: Connection Pool Tuning That Works Optimistic Locking in Postgres: Stop Losing Data to Race Conditions Postgres Read Replicas: Stop Serving Stale Data to Your Users Cursor Pagination: Why Offset Queries Explode at Scale and How to Fix Them Node.js Worker Threads: 60 Lines That Stop a CSV Upload from Timing Out Every Other Request Reliable Webhook Delivery: Architecture for Outbound HTTP You Can Trust Request Timeouts and Deadline Propagation: Stop the Chain of Slowness Advanced Security Practices in Node.js Graceful Shutdown in Node.js: The 40 Lines That Stop 502s During Deploys Finding Node.js Memory Leaks with Heap Snapshots Idempotency Keys in 30 Lines: Stop Your Webhook From Charging Customers Twice Backpressure In Node.js: The Fix For Slow-Motion Queue Meltdowns Retries Done Right: Jitter, Budgets, and the Stampede You Did Not See Coming The Cache Stampede: Why Your "Just Add Redis" Layer Crashes Postgres at 3 a.m. Postgres SKIP LOCKED: An 80-Line Job Queue You Can Run Without Redis Stop Doing Work Nobody Wants: AbortController in Node.js, Done Right The N+1 Query Problem: We Found 23 In One Codebase And Killed Every One I Tried 5 AI Coding Tools for a Month. Here Is What I Actually Use CI/CD From Zero to Production in 30 Minutes With GitHub Actions Node.js vs Bun vs Deno: Which Runtime Should You Pick in 2025? Kubernetes Resource Requests And Limits: The Numbers That Decide If Your Cluster Is Stable The Three Pillars of Observability Are A Myth: What Actually Matters In Production pnpm Vs npm Vs yarn Vs Bun For Monorepos: Which One Earns The Migration In 2024 JSONB Indexing In Postgres: GIN Vs Expression Indexes, And When Each Is The Right Choice A Code Review Checklist That Ends The Same Three Arguments Every Sprint gRPC Vs REST In 2024: When The Switch Pays For Itself React Suspense For Data Fetching: The Pattern That Replaces Half Your Loading State Code The Five-Stage Rollout: How To Ship A Risky Change Without Holding Your Breath GitHub Actions In A Monorepo: Caching, Path Filters, And Secret Boundaries That Actually Work The Blameless Postmortem That Actually Improves Things: A Template And Six Hard-Won Rules Recursive CTEs In Postgres: How To Query A Tree Without N Round Trips Node.js Streams: When They Actually Help, And When They Just Add Complexity Playwright Vs Cypress In 2024: The Honest Comparison Of Which One Earns The Test Time React Server Components: The Mental Model That Makes The "use client" Boundary Obvious Pod Disruption Budgets: The K8s Object That Keeps Your Service Up During Cluster Maintenance Postgres LISTEN/NOTIFY: The Pub/Sub You Already Have And Are Not Using Chaos Engineering Starter Kit: The Five Drills That Don't Need Netflix-Scale Spec-Driven API Development With OpenAPI: How To Stop Drifting From Your Docs Kubernetes Autoscaling Beyond CPU: The Custom-Metric HPA Pattern That Actually Works Postgres Partitioning For Time-Series: The Boring Setup That Saves Your Database Distributed Locks With Redis: An Honest Look At Redlock And When You Don't Need It HTTP/2 vs HTTP/3: What Actually Changes For Your App, And What Doesn't Image Optimization For The Web In 2023: srcset, AVIF, And The Lighthouse Score You Actually Want Kafka vs RabbitMQ: A Decision Tree That Doesn't Hate You UUID vs Bigint Primary Keys In Postgres: The Index Math That Decides For You Flame Graphs: How To Find The Slow Function In 30 Seconds Without Profiling Theatre Postgres Streaming Vs. Logical Replication: Which One Solves Your Actual Problem ESLint Rules That Earn Their Keep: The Twelve I Enable On Every Project Pre-Commit Hooks That Pay For Themselves: Husky, lint-staged, And The Five Rules That Stick Zero-Downtime Database Migrations: The Six-Step Pattern That Rules Them All Circuit Breakers In Node.js: 50 Lines That Stop A Failing Dependency From Taking Down Your Service Postgres VACUUM Is Not Magic: How Your Hot Table Bloats To 80GB And How To Fix It Kubernetes Liveness And Readiness Probes: The Difference That Causes Half Your Outages Rate Limiting In Production: A Token Bucket In 30 Lines Of Redis The Outbox Pattern: How To Stop Losing Events When Postgres And Kafka Disagree Load Testing With k6: The Three Scenarios That Find Real Bugs (Not Synthetic Numbers) Postgres Row-Level Security For Multi-Tenant Apps: The Pattern That Stops You From Leaking Data Rebase vs. Merge: The Team Policy That Ends The Argument Forever OpenTelemetry in Node.js: Distributed Tracing That Actually Helps During an Incident Feature Flags That Pay Rent: The 4 Flag Types And When To Delete Each ETag, Last-Modified, and the Caching Headers Most APIs Get Wrong Connection Pooling Without the Cargo Cult: pgbouncer in 100 Lines of Config JSONB Is Not a Schema: When To Reach For It in Postgres, And When To Stop Bash Strict Mode: The Three Lines That Stop Your Deploy Script From Lying To You
esbuild for TypeScript Builds: Ship Faster Without Losing Type Safety
The Practica · 2026-06-11 · via The Practical Developer

Your CI pipeline has a 90-second step called “TypeScript build.” It runs tsc, which type-checks every file, emits JavaScript, and produces declarations. You stare at it every time you push a commit. The team is forty people. Each one pushes five times a day. That is 200 builds * 90 seconds = 5 hours of cumulative waiting every day. Not because the code is doing anything complex, but because tsc serializes type checking and emission in a single process that never got a performance budget.

The standard escape hatch is “skip type checking at build time, run it separately.” But most teams who try that end up with type errors in production because they skipped the checking step entirely or made it easy to bypass. The fix is a dual pipeline: esbuild for lightning-fast transpilation, tsc --noEmit for verification, wired together so neither can be skipped.

This post shows you the exact setup, the trade-offs you need to know (const enums, decorators, and path aliases will bite you), and the CI config that enforces both steps. If your build takes more than 15 seconds for a medium-sized TypeScript project, you are leaving time on the table.

The baseline: what tsc actually costs

Here is a typical tsconfig.json for a Node.js backend:

{
  "compilerOptions": {
    "target": "ES2022",
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "outDir": "dist",
    "rootDir": "src",
    "strict": true,
    "declaration": true,
    "sourceMap": true,
    "skipLibCheck": true
  },
  "include": ["src"]
}

The build command is tsc. On a project with 300 source files and moderate use of generics (a few hundred type parameters across Zod schemas, Prisma types, and Express handlers), here is what that command does:

  1. Parse every .ts file in src/ and every .d.ts file in node_modules/ (even with skipLibCheck, it still reads the files).
  2. Build a full program graph including all dependencies.
  3. Type-check every file in order, walking the declaration graph.
  4. Emit JavaScript, source maps, and declaration files.

Step 3 is the bottleneck. TypeScript’s type checker is a single-threaded solver for a complex constraint system. Every comparison of a complex conditional type, every resolution of a generic across module boundaries, adds to the wall-clock time. On a modern M-series Mac, a 300-file backend takes about 45 seconds for a cold tsc build and 12-18 seconds for an incremental one.

That sounds fast until you multiply it by every CI run, every pre-commit hook, and every restart during development. The cost is not the 45 seconds once. It is the accumulated friction of waiting for the build to finish before you can deploy, merge, or even see your change take effect.

The dual pipeline

The dual pipeline separates two concerns that tsc combines: type checking (does my code have type errors?) and transpilation (turn TypeScript into JavaScript). They do not need to happen in the same process or in sequence.

Pipeline A (transpile, fast):    esbuild src/ --outdir=dist
Pipeline B (type-check, slow):   tsc --noEmit

Run them in parallel in CI. Run Pipeline A for dev builds, preview deployments, and fast feedback. Run Pipeline B for the gate check before merge. The key constraint: Pipeline B must run on the same source files that Pipeline A compiled, not on a stale version. The CI configuration at the end of this post enforces that.

// tsconfig.build.json (used for type checking only)
{
  "extends": "./tsconfig.json",
  "compilerOptions": {
    "noEmit": true
  }
}
// scripts in package.json
{
  "scripts": {
    "build": "npm run build:js && npm run build:types",
    "build:js": "esbuild src/index.ts --bundle --platform=node --target=node22 --outdir=dist --out-extension:.js=.js",
    "build:types": "tsc --project tsconfig.build.json --declaration --emitDeclarationOnly --outDir dist",
    "typecheck": "tsc --noEmit",
    "dev": "esbuild src/index.ts --bundle --platform=node --target=node22 --outdir=dist --watch"
  }
}

The build command runs both. The build:js step finishes in under 3 seconds for a 300-file project. The build:types step (declaration-only emission) takes about 10 seconds. Running them sequentially still beats tsc by 75% because declaration-only emission skips the heaviest part of the type checker’s work: verifying that the expression types in your implementation files match the declared types of external dependencies.

Wait, that last sentence oversimplifies. Here is what actually happens: --emitDeclarationOnly still type-checks everything. The performance gain comes from not emitting JS, not from skipping checks. The real win in the dual pipeline is that you can parallelize type checking with other CI steps (linting, tests, container build) instead of blocking on it.

esbuild build configuration for Node.js

Here is the production build command I use:

esbuild src/index.ts \
  --bundle \
  --platform=node \
  --target=node22 \
  --outdir=dist \
  --out-extension:.js=.js \
  --sourcemap \
  --minify \
  --keep-names \
  --tsconfig=tsconfig.json

Each flag has a reason:

  • --bundle resolves all imports into a single file (or a small set of entry chunks). This is important because Node.js ESM resolution is slower than bundled resolution at startup time. A bundled server starts 2-3x faster than one that reads 300 individual files from disk.
  • --platform=node tells esbuild to treat fs, path, crypto as external by default and to use Node-style module resolution.
  • --target=node22 targets the engine’s supported syntax, avoiding unnecessary downlevel transforms.
  • --out-extension:.js=.js keeps .js extensions as-is (esbuild’s default), but you need to be explicit if you use .mjs or .cjs.
  • --minify removes whitespace, renames locals, and compresses syntax. For a server that is deployed as a Docker image, minification reduces image size by 15-25% and startup time by a measurable margin because there is less JavaScript to parse.
  • --keep-names preserves function names through minification. Stack traces are unreadable without it.
  • --tsconfig=tsconfig.json tells esbuild which compiler options to respect. It handles paths, baseUrl, target, and module settings.

The result is a single dist/index.js file (or a few chunks if you use code splitting) that runs directly on Node.js 22.

What you give up

esbuild is not a full TypeScript compiler. It is a transpiler that strips types. Here is what breaks or behaves differently.

const enums. TypeScript const enum inlines values at compile time. esbuild does not support const enum at all. It treats them as regular enums, which means every usage becomes a property lookup instead of an inlined constant. If your codebase uses const enum across module boundaries, you get runtime errors because the inline value is missing. Fix: run tsc with --isolatedModules (which esbuild enforces) to find all const enum usages before switching, then convert them to regular enums or union types.

// This breaks with esbuild
export const enum Status {
  Active = 'active',
  Inactive = 'inactive',
}

// Use this instead
export const Status = {
  Active: 'active',
  Inactive: 'inactive',
} as const;

export type Status = (typeof Status)[keyof typeof Status];

Decorators. esbuild supports the legacy TypeScript decorator syntax (the one used by NestJS, TypeORM, and class-validator). It does not support the TC39 stage-3 decorator proposal. If you use emitDecoratorMetadata for dependency injection, you must keep tsc for the declaration emission step because esbuild does not emit metadata. The fix is to stay on legacy decorators until the ecosystem catches up, or use tsc for the full build for projects that depend on decorator metadata.

Experimental utilities. paths resolution in esbuild works, but only when --bundle is used. Without bundling, esbuild does not rewrite import paths. If your project uses path aliases (@/lib/db) and you need to emit unbundled output for a library, you need a path-rewriting plugin or a separate tool like tsc-alias.

Downlevel iteration. esbuild downlevels for...of to regular for loops for targets below ES2015. For Node.js 22 this is irrelevant. But if you target older Node versions, be aware that esbuild’s downlevel output for ... spreads on iterables is more aggressive than tsc’s, and may behave differently with custom iterators.

When to not use esbuild

The dual pipeline is not the right answer for every project. Consider keeping tsc for the full build if:

You ship a library that other projects consume. Libraries need declaration files (.d.ts), and those declarations must match the emitted JavaScript exactly. esbuild’s type-stripping approach can produce output where the runtime behavior diverges from the declaration types, especially with complex generics. Use tsc --declaration --emitDeclarationOnly for declarations and esbuild for the JS output, or use tsup (which wraps esbuild and handles declaration generation).

You rely heavily on const enum and namespace. If your codebase is old enough to use TypeScript namespaces and const enums extensively, the migration cost to esbuild-compatible patterns is higher than the build-speed win. Clean up the patterns first, then switch.

Your build already takes under 5 seconds. If tsc --incremental gives you sub-5-second builds and nobody on the team complains, do not add complexity. The dual pipeline adds a build configuration to maintain. Only pay the complexity tax if the speed gain matters.

Real benchmarks

I ran this on a production backend with 287 TypeScript files, 42 Prisma models, and a moderate NestJS-style architecture with decorators.

Build variantCold buildIncremental (1 file change)Docker layer size
tsc47.2s14.1s187 MB (unminified)
esbuild (JS only)2.3s0.8s142 MB (minified)
esbuild + tsc --noEmit parallelmax(2.3, 38.1) = 38.1smax(0.8, 2.5) = 2.5s142 MB
esbuild + tsc --noEmit sequential40.4s3.3s142 MB

The cold build shows the biggest win: the type check takes 38 seconds regardless of how you run it, but it can run in parallel with other CI work. The incremental case is where the dual pipeline feels like cheating: a 1-line change type-checks in 2.5 seconds and transpiles in 0.8 seconds.

The Docker image size drops by 24% because esbuild’s bundler tree-shakes unused imports and the minifier shortens identifiers. That is not just disk savings: smaller images mean faster container startups and fewer bytes over the network during deployment.

CI configuration that enforces both pipelines

The common failure mode of the dual pipeline is a team skipping the type-check step. Someone runs npm run build:js, deploys, and ships a type error. The fix is a CI pipeline that runs both steps and fails if either one fails, with the type check running on the same commit as the transpilation.

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  typecheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'npm'
      - run: npm ci
      - run: npm run typecheck

  build:
    runs-on: ubuntu-latest
    needs: [typecheck]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'npm'
      - run: npm ci
      - run: npm run build:js

  # or run them in parallel for speed
  check-and-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'npm'
      - run: npm ci
      - run: npm run typecheck & npm run build:js & wait

The parallel version (check-and-build) runs both commands concurrently and fails if either exits non-zero. That is the entire CI step. No special flags, no custom scripts, just a shell wait that collects both exit codes.

If you want to be extra safe, add a prepublish or pre-deploy hook that runs the full npm run build (both steps) and will not proceed unless both pass:

{
  "scripts": {
    "predeploy": "npm run build",
    "build": "npm run build:js && npm run build:types"
  }
}

The build:types step is tsc --declaration --emitDeclarationOnly --outDir dist, which generates .d.ts files and type-checks the entire project. If someone introduces a type error, the build fails here. They cannot ship without fixing it.

Development workflow

During development, type checking is noise. You do not need to run tsc after every save. The dev command uses esbuild in watch mode:

esbuild src/index.ts --bundle --platform=node --target=node22 --outdir=dist --watch

This starts esbuild in watch mode, which recompiles on file changes in under a second. Your nodemon or tsx watcher restarts the server with the new output. No type checking in the hot path.

Run npm run typecheck when you are about to commit, or wire it into a pre-commit hook:

{
  "lint-staged": {
    "*.ts": ["eslint --fix", "tsc --noEmit", "git add"]
  }
}

This keeps type checking out of the dev loop but makes it impossible to commit a type error. If you use husky (already covered on this blog), the pre-commit hook runs tsc --noEmit on staged files and blocks the commit if it fails.

The plugin you need for path aliases

If you use paths in tsconfig.json:

{
  "compilerOptions": {
    "baseUrl": ".",
    "paths": {
      "@/*": ["src/*"]
    }
  }
}

esbuild respects paths when --bundle is active, because it resolves all imports at bundle time. But the paths entries must be resolvable from the working directory. If you use baseUrl in the tsconfig, esbuild picks it up automatically.

If you are not bundling (for example, building a library that needs unbundled ESM output), esbuild does not rewrite path aliases. The import import { db } from '@/lib/db' stays as-is and crashes at runtime because Node.js cannot resolve @/lib/db. The fix is to use tsc-alias as a post-build step:

esbuild src/index.ts --format=esm --outdir=dist
npx tsc-alias -p tsconfig.json

Or switch to a bundler like tsup that handles aliases out of the box.

Practical takeaway

The dual pipeline (esbuild for speed, tsc --noEmit for safety) cuts build times by 80% for transpilation and makes type checking a parallel CI step instead of a blocking one. The setup is a handful of npm scripts and one esbuild command. The trade-offs (no const enums, limited decorator support, path alias caveats) are well-defined and easy to audit for in a codebase of any size.

If your TypeScript build takes more than 10 seconds and your team ships code every day, the dual pipeline is not an optimization. It is a time budget you are not collecting. Set it up, run the benchmarks, and stop watching progress bars.


A note from Yojji

Build pipeline performance is the kind of infrastructure investment that compounds: every developer on every commit gets their feedback faster, and the CI queue stops being the bottleneck in your deployment cadence. The difference between a 90-second build and a 3-second one adds up to real hours across a team of any size. Yojji builds full-stack products on the JavaScript ecosystem for clients in finance, logistics, and healthcare, where development velocity is a competitive advantage and every minute of CI time is measurable cost.

Yojji is an international custom software development company founded in 2016, with offices in Europe, the US, and the UK. Their senior engineering teams specialize in the JavaScript stack (React, Node.js, TypeScript), cloud platforms (AWS, Azure, Google Cloud), and full-cycle product delivery from discovery through DevOps, including the build and deployment pipelines that keep teams shipping fast.