chore(deps): override esbuild to ^0.28.1 (CVE fix)

[cliffhall]

Summary

Adds an npm overrides entry forcing esbuild to ^0.28.1, which resolves the moderate-severity dev-server arbitrary file read advisory affecting esbuild < 0.28.1 (on Windows). esbuild is a transitive dev dependency pulled in by vite and vitest; it previously resolved to 0.27.7. The existing get-intrinsic override is preserved.

"overrides": {
  "get-intrinsic": "1.3.0",
  "esbuild": "^0.28.1"
}

Verification

• npm ls esbuild --all → esbuild resolves to 0.28.1 everywhere (under vite 7.3.6 and tsx/vitest).
• npm audit → 0 vulnerabilities.
• npm run check-version → pass.
• cd client && npm run lint → pass.
• cd client && npm test → 535 passed.
• cd cli && npm test → 85 passed.
• npm run build → pass (client + cli).

Forcing esbuild 0.28.1 does not break the client build or tests — no vite bump was required for this fix.

Note: repo-wide prettier --check currently flags 5 pre-existing client files unrelated to this change. This is caused by prettier floating to 3.9.5 (package.json allows ^3.7.1) whose formatting rules differ from the 3.7.4 the files were formatted with. It is a separate, pre-existing drift and is intentionally out of scope for this security fix.

Resolves Dependabot alert #121
Part of #1706

🤖 Generated with Claude Code

https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1

[cliffhall]

@claude review — security dependency fix adding an esbuild override to ^0.28.1 (part of #1706). Verify it resolves the advisory, the override is correct, and nothing is broken. Flag anything actionable.

[claude]

Claude finished @cliffhall's task in 1m 34s —— View job

---

Review: esbuild override → ^0.28.1 (CVE fix)

• Verify package.json override is correct
• Confirm esbuild resolves to >=0.28.1 in the lockfile
• Verify the advisory is addressed
• Check nothing else is broken (audit / resolution)
• Post review findings

Verdict: ✅ LGTM — clean, correct, minimal security fix. No blocking issues.

What I verified

Override is correct — package.json adds "esbuild": "^0.28.1" alongside the preserved get-intrinsic override:

"overrides": {
  "get-intrinsic": "1.3.0",
  "esbuild": "^0.28.1"
}

Lockfile resolves everything to 0.28.1 — there is exactly one esbuild install in package-lock.json (node_modules/esbuild@0.28.1, package-lock.json:6247-6250), fully deduped with matching @esbuild/* platform packages all at 0.28.1. No stray older copies (no esbuild-0.2[0-7] entries remain).

Consumers are satisfied by the forced version — both transitive consumers accept 0.28.1, so the override doesn't create an unsatisfiable constraint:

• vite@7.3.6 → esbuild: "^0.27.0 || ^0.28.0" (package-lock.json:12638)
• tsx@4.23.1 → esbuild: "~0.28.0" (package-lock.json:12345)

Dev-only blast radius — esbuild is a "dev": true transitive dependency; the override cannot affect the published/runtime artifact. Appropriate scoping for this fix.

npm audit → found 0 vulnerabilities (run against the lockfile in this checkout), consistent with the PR's claim that the advisory is resolved. I could not independently fetch the GHSA page (WebFetch/WebSearch not permitted in this run), so I confirmed remediation via npm audit rather than by cross-checking the advisory's affected-range text.

Notes (non-blocking)

• Caret on a 0.x version — ^0.28.1 resolves to >=0.28.1 <0.29.0, which acts as a good security floor while still allowing patch/minor bumps. Heads-up for the future: if a later vite/tsx requires esbuild@0.29+, this pin will need to be bumped or it'll block the upgrade. Fine for now.
• Prettier drift — the PR note about 5 pre-existing prettier --check failures is accurate and correctly scoped out; it's unrelated to this change.
• Lockfile churn — the large +1548/-1863 diff in package-lock.json is expected: forcing the esbuild bump re-resolves/reorders the tree. Nothing suspicious in the resolved versions.

The two changed files are exactly what a fix of this kind should touch, and nothing else was modified.
• deps/security-esbuild

[cliffhall]

Superseded by #1718, which regenerates the lockfile with version-targeted overrides so every transitive copy is patched (npm wouldn't apply these overrides to the existing lockfile minimally, leaving residual vulnerable copies). js-yaml (#1713) was already resolved on main. See #1718 for the verified ALL-CLEAN result. Part of #1706.