[pollosp]

Why

Dependabot reports two esbuild vulnerabilities. esbuild is a build and dev tool here. It does not run in the deployed app.

This PR adds two narrow pnpm.overrides. The parents pin esbuild to a vulnerable range, and no newer parent version fixes it:

• @esbuild-kit/core-utils@3.3.2 (from drizzle-kit) pins esbuild ~0.18.20. The latest drizzle-kit (0.31.11) still uses it.
• tsup@8.5.1 (latest) pins esbuild ^0.27.0.

Changes

Package	From	To	Bump type	Advisory	Severity	Alert #
esbuild (via @esbuild-kit/core-utils, used by drizzle-kit)	0.18.20	0.25.0	minor (0.x)	GHSA-67mh-4wv8-2f99 (dev server accepts requests from any website)	medium	#381
esbuild (via tsup, bundle-require, vite)	0.27.7	0.28.2	minor (0.x)	GHSA-g7r4-m6w7-qqqr (dev server arbitrary file read)	low	#414

Overrides (root package.json):

"@esbuild-kit/core-utils>esbuild": "0.25.0",
"esbuild@>=0.27.3 <0.28.1": "0.28.2"

Notes:

• 0.25.0 is the first fixed version for #381.
• For #414 the first fixed version is 0.28.1. I use 0.28.2 because tsx already uses 0.28.2 in this lockfile. With 0.28.1, pnpm moves tsx down to 0.28.1. With 0.28.2, all consumers share one version.
• Both target versions have no active advisory. (GHSA-gv7w-rqvm-qjhr matches 0.25.0, but GitHub withdrew it.)
• The lockfile diff changes only esbuild, the @esbuild/* platform binaries and the peer keys of vite, vitest and bundle-require.

Risk: low

• Only build and dev tools change: tsup (package builds), vitest/vite (tests) and drizzle-kit (local DB commands). No runtime dependency of apps/web changes.
• In 0.x, a minor bump can contain breaking changes. The checks below cover each consumer.
• drizzle-kit does not run in CI. I tested it by hand (see below).

How I tested

Local, Node 20.19.6, pnpm 10.33.0. Same steps as .github/workflows/ci.yml:

Command	Result
pnpm install --frozen-lockfile	pass
pnpm turbo run build --filter='./packages/*' --force	pass
pnpm turbo run typecheck --force	pass
pnpm turbo run test --force	pass, 159 tests (same as main)
pnpm turbo run build --filter=@agent-commerce/web --force (CI placeholder env)	pass
pnpm exec drizzle-kit generate (in apps/web)	pass, "No schema changes"
transformSync from @esbuild-kit/core-utils	pass, it resolves esbuild 0.25.0
pnpm audit	34 findings on main, 32 on this branch. No esbuild findings.

Not fixed in this PR

• Other open alerts (next, sharp, ws, @metamask/sdk) are in separate PRs because they change runtime code.
• Alerts that need a major version or have no fix are listed in those PRs.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agent-commerce-sample-app	Ready	Preview	Oct 2, 2026 8:23am UTC