Skip to content

chore(deps): override esbuild ^0.28.1 (Dependabot GHSA missing binary integrity check)#80

Merged
mandarini merged 1 commit into
mainfrom
fix/esbuild-security-issue
Jun 16, 2026
Merged

chore(deps): override esbuild ^0.28.1 (Dependabot GHSA missing binary integrity check)#80
mandarini merged 1 commit into
mainfrom
fix/esbuild-security-issue

Conversation

@mandarini

@mandarini mandarini commented Jun 16, 2026

Copy link
Copy Markdown
Collaborator

Forces esbuild >=0.28.1 via a pnpm.overrides block in pnpm-workspace.yaml to address Dependabot alert (GHSA: esbuild missing binary integrity check in the Deno module). esbuild is transitive via vitest -> vite, so a direct bump isn't possible and an override is the surgical fix.

Because 0.28.1 was published only 4 days ago and the workspace gates new packages with a 7-day minimumReleaseAge, esbuild and @esbuild/* were temporarily added to minimumReleaseAgeExclude. We will remove that exclusion after 7 days, once 0.28.1 clears the age gate (the override itself can be dropped later, once vite ships an updated esbuild natively).

Verified locally: pnpm typecheck, pnpm lint, 185 vitest tests, and pnpm build all pass. Lockfile diff touches only esbuild and @esbuild/* entries.

@mandarini mandarini changed the title chore(deps): override esbuild ^0.28.1 (Dependabot #37, GHSA missing binary integrity check) chore(deps): override esbuild ^0.28.1 (Dependabot GHSA missing binary integrity check) Jun 16, 2026
@pkg-pr-new

pkg-pr-new Bot commented Jun 16, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@supabase/server@80

commit: 9d3fae6

@mandarini mandarini force-pushed the fix/esbuild-security-issue branch from 7af5e9f to 9d3fae6 Compare June 16, 2026 07:26
@mandarini mandarini marked this pull request as ready for review June 16, 2026 07:27
@mandarini mandarini requested review from a team as code owners June 16, 2026 07:27
@mandarini mandarini self-assigned this Jun 16, 2026
@mandarini mandarini merged commit 5174b0a into main Jun 16, 2026
7 checks passed
@mandarini mandarini deleted the fix/esbuild-security-issue branch June 16, 2026 12:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants