Backport esbuild 0.28.1 to Vite 7.3 for GHSA-gv7w-rqvm-qjhr

[dirkluijk]

Would it be possible to backport the esbuild 0.28.1 update to the Vite 7.3 line?

esbuild 0.28.1 fixes security advisory GHSA-gv7w-rqvm-qjhr:
GHSA-gv7w-rqvm-qjhr

Vite 7.3 currently depends on esbuild ^0.27.0, which means consumers on Vite 7 still resolve to a vulnerable esbuild version according to security tooling.

We are currently staying on Vite 7 because upgrading further is blocked by decorator-related issues in our codebase/tooling. Since the Vite release policy mentions that important fixes and security patches may be backported to supported older lines, it would be very helpful if this esbuild patch could also land in Vite 7.3.

Thanks!

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[Jordanl123]

Would a new issue be required to get a backport to V6? This adds more complexity as esbuild jumping from ^0.25.0 to 0.28.1 means lost support for transformation of some JavaScript syntax on older browsers, e.g. destructuring. The default target environments in version 6.4.3 of Vite include "chrome87", "edge88", "es2020", "firefox78", "safari14" and are no longer supported by esbuild 0.28.1.

[evanw]

Hello. Author of esbuild here. This security advisory is Deno-specific, and has nothing to do with npm or Vite. It looks like it was associated with the wrong package in GitHub's system. I'll work on revoking it. Once that is done, you will hopefully no longer need to do anything on your end. See evanw/esbuild#4483 for more info. Sorry about the trouble.

[evanw]

The advisory has now been withdrawn: GHSA-gv7w-rqvm-qjhr

[tats-u]

Is it safe to override esbuild used by Vite 7 to 0.28.x as long as we use supported Node versions?

Vite 7 is used by the latest Astro.

[bluwy]

FWIW I think we can backport to allow 0.28 even if there's no vulnerability report now, as long as there's no significant breaking changes that requires us to handle. 0.28 should be safe to use as is.

[mikethea1]

GHSA-g7r4-m6w7-qqqr also wants esbuild to be upgraded to 0.28.1

[sapphi-red]

v7.3.6 is now released with esbuild 0.28 in the range.