fix(deps): bump esbuild 0.19.12 -> 0.25.12 (clears last open alert) - #22
Merged
Conversation
…dles Clears the one open Dependabot alert (GHSA-67mh-4wv8-2f99, esbuild's dev server accepting cross-origin requests). The advisory does not actually apply to this repo — scripts/build.js only ever calls esbuild.buildSync, never `serve` — but the fix is cheap and the alert was the last one outstanding here. esbuild is a direct devDependency, so this crosses six 0.x minors. The API surface in use is just buildSync with bundle/platform/target/ outfile/banner options, all unchanged across that range. scripts/dist/*.cjs are committed build artifacts consumed by the composite actions, so they are rebuilt here. The discover bundle shrinks by ~400 lines net, which is 0.25's tighter codegen rather than dropped functionality. Verified: - npm audit: 0 vulnerabilities - npm test: 32/32 pass - both bundles pass `node --check` and are require()-able - mode stays 100755, which .github/workflows/test.yml asserts - ran the three bundle entrypoints test.yml exercises against test-fixtures/valid: discover-all, validate, generate — all exit 0 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018DDkZGNoSVspVq1Z9jcVtP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the one open Dependabot alert here — GHSA-67mh-4wv8-2f99, esbuild's dev server accepting cross-origin requests.
Worth saying plainly: the advisory doesn't actually apply to this repo.
scripts/build.jsonly ever callsesbuild.buildSync; nothing runsesbuild serve. But the fix is cheap and this was the last alert outstanding, so it's worth taking.esbuild is a direct devDependency, so this crosses six 0.x minors (0.19 → 0.25). The only API in use is
buildSyncwithbundle/platform/target/outfile/banner— all unchanged across that range.scripts/dist/*.cjsare committed build artifacts consumed by the composite actions, so they're rebuilt here. The discover bundle shrinks ~400 lines net; that's 0.25's tighter codegen, not dropped functionality.Verified
npm audit→ 0 vulnerabilitiesnpm test→ 32/32 passnode --checkand arerequire()-able100755—.github/workflows/test.ymlasserts the executable bit, and a rebuild can silently drop ittest.ymlexercises againsttest-fixtures/valid:discover-all,validate,generate— all exit 0🤖 Generated with Claude Code
https://claude.ai/code/session_018DDkZGNoSVspVq1Z9jcVtP