Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Sichere ProgrammierungFliproom: a room changeover is a content problem(21.09.2026 um 04:10 Uhr)
Sichere ProgrammierungNova Adiutrix: My Second Agent Built My First Project's To-Do List(21.09.2026 um 04:11 Uhr)
IT Security ToolsAntiphishing v35456910988(21.09.2026 um 02:35 Uhr)
IT Security Toolsbrave-browser v1.98.12(21.09.2026 um 03:35 Uhr)
Sichere ProgrammierungFliproom: a room changeover is a content problem(21.09.2026 um 04:10 Uhr)
Sichere ProgrammierungNova Adiutrix: My Second Agent Built My First Project's To-Do List(21.09.2026 um 04:11 Uhr)
IT Security ToolsAntiphishing v35456910988(21.09.2026 um 02:35 Uhr)
IT Security Toolsbrave-browser v1.98.12(21.09.2026 um 03:35 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

Importmap or jsbundling? I use both

Reagiere als Erste:r — dein Feedback zählt!

Starting from Rails 7, Importmap has become the default mechanism for handling JavaScript loading. It can fully utilize HTTP/2's parallel download and caching mechanisms, avoiding the need to download all code every time a change is made by bundling everything into one large package.

For js dependencies, Importmap provides a pin feature, for example, by running:

./bin/importmap pin local-time

Importmap will download the local-time js file from the CDN and place it in the vendor/javascript directory, automatically adding the configuration to config/importmap.rb. Then you can import it in your js file:

import LocalTime from "local-time"
LocalTime.start()

However, some js libraries assume developers will use bundling tools and do not package the source code into a complete bundle but instead split it into many files. In this case, using importmap pin will encounter problems. For example, with Lit, if you execute:

bin/importmap pin lit

You will see the output:

Pinning "lit" to vendor/javascript/lit.js via download from https://ga.jspm.io/npm:[email protected]/index.js
Pinning "@lit/reactive-element" to vendor/javascript/@lit/reactive-element.js via download from https://ga.jspm.io/npm:@lit/[email protected]/reactive-element.js
Pinning "lit-element/lit-element.js" to vendor/javascript/lit-element/lit-element.js.js via download from https://ga.jspm.io/npm:[email protected]/lit-element.js
Pinning "lit-html" to vendor/javascript/lit-html.js via download from https://ga.jspm.io/npm:[email protected]/lit-html.js
Pinning "lit-html/is-server.js" to vendor/javascript/lit-html/is-server.js.js via download from https://ga.jspm.io/npm:[email protected]/is-server.js

You can see that Lit references many sub-packages. The problem is that even after downloading so many packages, the import is still incomplete. If you import { LitElement } from "lit" in your js code, you will get an error in the browser:

GET http://localhost:3000/assets/css-tag.js net::ERR_ABORTED 404 (Not Found)

This is because the @lit/reactive-element package has many optional modules that were not downloaded. But if you download all optional modules, the importmap configuration will become very bloated. There is a PR in progress (#235), but it's hard to say if it will solve the problem because the issue lies in the library authors not considering the need for unbundled imports.

So why not change the approach: first use jsbundling to bundle the dependencies, and then use importmap to import them. Here's how to achieve it.

Implementation

Assuming you have already created a project using Rails and are using importmap by default:

rails new myapp

The code is tested on Rails 8.0.0.beta1 but should work for Rails 7+.

Next, install jsbundling:

./bin/bundle add jsbundling-rails
./bin/rails javascript:install:esbuild

At this point, you will see js compilation errors because the default configurations of jsbundling and importmap conflict. Next, we will fix the conflicts.

Remove this line from app/views/layouts/application.html.erb:

  <%= javascript_include_tag "application", "data-turbo-track": "reload", type: "module" %>

Modify package.json to:

  "scripts": {
    "build": "esbuild app/assets/javascripts/*.* --bundle --sourcemap --format=esm --outdir=app/assets/builds --public-path=/assets"
  }

Note that the path is changed to app/assets/javascripts/*.*, which is the directory where js files that need to be compiled by esbuild will be placed in the future.

Add the following to config/application.rb:

config.assets.excluded_paths << Rails.root.join("app/assets/javascripts")

Create the folder app/javascript/src/ and add the file app/assets/javascripts/lit.js with the content:

export * from 'lit';

Install the lit package via yarn:

yarn add lit

Add the following configuration to config/importmap.rb:

pin "lit", to: "lit.js"

Now start the development process with ./bin/dev, and you will see esbuild compile lit to app/assets/builds/lit.js. Open the browser and view the page source; the importmap content has increased:

  "imports": {
    ...
    "lit": "/assets/lit-9c62c803.js",
    ...
  }

The entire workflow is: esbuild compiles the source code in app/assets/javascripts to app/assets/build, the content of app/assets/build is processed by the assets pipeline, and the import name and file name mapping is added in config/importmap.rb, so the module can be imported by the application's js code.

Now, you can import { LitElement } from "lit" in your js.

Summary

This article uses a combination of esbuild and importmap to solve the problem of importmap being unable to handle complex dependencies. Although this breaks the expectation of nobuild, it still takes advantage of fine-grained caching. Until importmap is widely compatible with js packages, you can use this method to handle complex dependencies.

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Importmap or jsbundling? I use both

Thematisch verwandte Begriffe: Importmap, jsbundling, both · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-93977 | A vulnerability was determined in code-projects Assessment Management 1.…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick