chore(security): clean cves (#6509)

Author: dotansimha

configs/cargo/Cargo.lock

@@ -15,7 +15,7 @@
   "packageManager": "[email protected]",
   "engines": {
     "node": ">=22",
-    "pnpm": ">=9.15.5"
+    "pnpm": ">=10"
   },
   "scripts": {
     "build": "pnpm turbo build --color",
@@ -101,11 +101,13 @@
     "vitest": "3.0.5"
   },
   "pnpm": {
+    "overrides.esbuild": "To address CVE: https://github.com/graphql-hive/console/security/dependabot/259",
     "overrides.csstype": "To fix type check error https://github.com/JedWatson/react-select/issues/5952",
     "overrides.mjml": "Our patch removes html-minifier from mjml-core, we dont need this dependency and its causing false-alarm (CVE https://nvd.nist.gov/vuln/detail/cve-2022-37620)",
     "overrides.ip": "There is no update with fix for ip package, we use fork https://github.com/indutny/node-ip/issues/150#issuecomment-2325961380",
     "overrides.miniflare": "To address CVE: https://github.com/graphql-hive/console/security/dependabot/245",
     "overrides": {
+      "esbuild": "0.25.0",
       "csstype": "3.1.2",
       "[email protected]>html-minifier": "-",
       "[email protected]>html-minifier": "-",

package.json

@@ -61,7 +61,7 @@
   },
   "devDependencies": {
     "@apollo/composition": "2.9.3",
-    "esbuild": "0.24.2",
+    "esbuild": "0.25.0",
     "fastify": "4.29.0",
     "graphql": "16.9.0"
   },

packages/libraries/external-composition/package.json

@@ -11,7 +11,7 @@
     "@cloudflare/workers-types": "4.20241230.0",
     "@types/service-worker-mock": "2.0.4",
     "@whatwg-node/server": "0.9.65",
-    "esbuild": "0.24.2",
+    "esbuild": "0.25.0",
     "itty-router": "4.2.2",
     "toucan-js": "3.4.0",
     "undici": "6.21.1",

packages/services/broker-worker/package.json

@@ -22,7 +22,7 @@
     "@whatwg-node/server": "0.9.65",
     "bcryptjs": "2.4.3",
     "dotenv": "16.4.7",
-    "esbuild": "0.24.2",
+    "esbuild": "0.25.0",
     "fastify": "4.29.0",
     "graphql": "16.9.0",
     "itty-router": "4.2.2",

packages/services/cdn-worker/package.json

@@ -130,7 +130,7 @@
     "urql": "4.1.0",
     "use-debounce": "10.0.4",
     "valtio": "1.13.2",
-    "vite": "6.0.11",
+    "vite": "6.1.0",
     "vite-tsconfig-paths": "5.1.4",
     "wonka": "6.3.4",
     "yup": "1.6.1",