chore(deps): override esbuild to ^0.28.1 — clear dev-only audit advisory, un-red main

[jasperboerhof]

What

Adds an esbuild: ^0.28.1 override to the root overrides block, clearing the dev-only advisory GHSA-gv7w-rqvm-qjhr (esbuild dev-server request SSRF/RCE) carried transitively via vitepress → vite → esbuild.

Why a standalone PR

The advisory was published after main last went green, and the CI check job runs a hard npm audit (no --omit=dev) as its first step — so it now fails on every branch, including main's next push, short-circuiting all 7 downstream gates. This override un-reds main on its own merit.

It was originally bundled into #120 (the extend hook feature). Per review feedback, lifting it out so:

• main can go green independently of the feature debate, and
• feat(adapter-store): add extend config hook for consumer-defined store methods #120's diff stays scoped to the extend hook.

Scope

• package.json — one line added to the existing overrides block.
• package-lock.json — regen of the esbuild/vite/vitepress subtree only.

Dev-only dependency (docs tooling); no production runtime or published-package impact. The esbuild major bump (0.27 → 0.28) affects local docs builds only.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying fs-packages with    Cloudflare Pages

Latest commit:	18a06d8
Status:	✅  Deploy successful!
Preview URL:	https://464c7532.fs-packages.pages.dev
Branch Preview URL:	https://chore-esbuild-override-0-28.fs-packages.pages.dev

View logs

[Goosterhof]

✅ Approve-worthy

0 blockers · 1 concern · 0 nits · 1 praise · 1 inline

Round 1. CI check green (4m21s).

Standalone dev-only esbuild: ^0.28.1 override to clear GHSA-gv7w-rqvm-qjhr and un-red main. The "why a standalone PR" rationale checks out: ci.yml:18 runs a bare npm audit (no --omit=dev) as the second step of the single check job, so a dev advisory short-circuits all downstream gates on every branch incl. main's next push. The override resolves the entire esbuild subtree to 0.28.1 in the lock (verified — main was at 0.27.7), and the green check run is the proof of compatibility: that one job runs npm run test:coverage + npm run test:mutation, both vitest-driven, so the 0.27 → 0.28 major bump is empirically safe for the test runner, not only docs.

Findings (detail inline)

• package.json:42 — scope claim understates blast radius (concern)

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.

[jasperboerhof]

Review Loop · 10/10 · PASS

fs-packages #126 · AC anchor: none (no issue/plan/PR-AC anchor; self-evident dep-override PR) · head 18a06d83fe

Tip

No findings — clean against the review checklist.

Action

merge-ready

[Goosterhof]

Confirmed identical to the override I'd split out in parallel (now closed as #127) — same hunk, lockfile keeps all @script-development/* on workspace links, audit goes 3 high → 0. This is the canonical esbuild fix. Heads-up for merge order: #128 (broadcast hardening) is branched off main so it inherits the audit-red until this lands; merge #126 first and #128 rebases green.