Skip to content

Conversation

@tanjeemh
Copy link
Contributor

@tanjeemh tanjeemh commented Nov 19, 2025

What problem are we solving?
Addressing ESBuild Development Server CORS Vulnerability GHSA-67mh-4wv8-2f99 .

Vulnerable version resolved:

  • esbuild@0.20.2 (via @bitgo/babylonlabs-io-btc-staking-ts)

Why are we solving it this way?
As we can see, the outdated esbuild@0.20.2 in the @bitgo/babylonlabs-io-btc-staking-ts module was creating this vulnerability. By updating its respective esbuild devDependancy in its package.json, and reflecting this update in the yarn.lock file, we can effectively update the outdated version.

How has this been tested?
Before:

BitGoJS % yarn why esbuild
=> Found "esbuild@0.20.2"
BitGoJS % npm ls esbuild
├─┬ @bitgo/babylonlabs-io-btc-staking-ts@3.1.0 -> ./modules/babylonlabs-io-btc-staking-ts
│ └── esbuild@0.20.2

After:

BitGoJS % yarn why esbuild
=> Found "esbuild@0.26.0"
BitGoJS % npm ls esbuild
├─┬ @bitgo/babylonlabs-io-btc-staking-ts@3.1.0 -> ./modules/babylonlabs-io-btc-staking-ts
│ └── esbuild@0.26.0

Ticket: DX-1552

@tanjeemh tanjeemh requested a review from a team as a code owner November 19, 2025 17:42
@tanjeemh tanjeemh merged commit ed38afd into master Nov 20, 2025
14 checks passed
@tanjeemh tanjeemh deleted the DX-1552 branch November 20, 2025 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants