chore(deps): bump esbuild from 0.25.4 to 0.28.1

[dependabot]

Bumps esbuild from 0.25.4 to 0.28.1.

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

• Allow import path specifiers starting with #/ (#4361)

  Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

  This change was contributed by @​hybrist.

• Automatically add the -webkit-mask prefix (#4357, #4358)

  This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

  /* Original code */
  main {
    mask: url(x.png) center/5rem no-repeat
  }
  /* Old output (with --target=chrome110) */
  main {
  mask: url(x.png) center/5rem no-repeat;
  }
  /* New output (with --target=chrome110) */
  main {
  -webkit-mask: url(x.png) center/5rem no-repeat;
  mask: url(x.png) center/5rem no-repeat;
  }

  This change was contributed by @​BPJEnnova.

• Additional minification of switch statements (#4176, #4359)

  This release contains additional minification patterns for reducing switch statements. Here is an example:

  // Original code
  switch (x) {
    case 0:
      foo()
      break
    case 1:
    default:
      bar()
  }

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[kadel]

https://github.com/dependabot rebase

[kadel]

@dependabot rebase

[kadel]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[kadel]

@dependabot rebase

[dependabot]

Dependabot can't parse your yarn.lock. Because of this, Dependabot cannot update this pull request.

[kadel]

@dependabot rebase

[kadel]

@dependabot rebase

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure (validation failed after 1 iteration(s)) · Started 8:14 AM UTC · Completed 8:16 AM UTC

Commit: 1f05626 · View workflow run →

Runtime: claude · Model: sonnet → claude-sonnet-4-6 · Effort: high

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 8:34 AM UTC · Completed 8:41 AM UTC

Commit: 1f05626 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.60

[fullsend-ai-retro]

Retro: PR #125 — chore(deps): bump esbuild from 0.25.4 to 0.28.1

Workflow outcome: Review agent failed; PR merged by human without agent review.

Timeline

1. 2026-06-12 — Dependabot opened PR chore(deps): bump esbuild from 0.25.4 to 0.28.1 #125 to bump esbuild 0.25.4 → 0.28.1 (2 files: package.json, yarn.lock).
2. 2026-08-21 — kadel attempted multiple @dependabot rebase commands; Dependabot reported it couldn't parse yarn.lock. kadel eventually resolved this manually.
3. 2026-09-09 08:13 UTC — PR activity triggered the fullsend review agent (run 34327922668).
4. 2026-09-09 08:15:23 UTC — Review agent launched with claude-sonnet-4-6 (resolved from model: sonnet in .fullsend/harness/review.yaml).
5. 2026-09-09 08:15:28 UTC — Agent crashed immediately: The model claude-sonnet-4-6 is not available on your vertex deployment. Zero tokens consumed, no output produced.
6. 2026-09-09 08:15:28 UTC — Validation failed because agent-result.json was never created. Status comment posted: "Failure (validation failed after 1 iteration(s))".
7. 2026-09-09 08:14:30 UTC — kadel approved the PR (before the review agent finished).
8. 2026-09-09 08:33:17 UTC — PR merged.
9. 2026-09-09 08:33:20 UTC — Retro agent dispatched (run 34329756399).

Analysis

The review agent provided zero value on this PR — it crashed before making a single API call due to the claude-sonnet-4-6 model not being provisioned on the repo's Vertex AI endpoint. The human maintainer (kadel) reviewed and merged the straightforward dependency bump independently.

All findings already covered by existing issues

Every potential improvement identified in this retro is already tracked:

• Model unavailability — redhat-developer/rhdh-cli#187 covers this exact failure (filed by a prior retro on PR chore: upgrade fullsend review harness #181, which introduced the review.yaml config). PR chore(deps): bump esbuild from 0.25.4 to 0.28.1 #125's failure is additional evidence that the issue persists and affects all PRs, not just the one that introduced the config. Platform-level model fallback is tracked in fullsend-ai/fullsend #7026, #1771, #6922, and #423.

• Generic error message — The status comment "validation failed after 1 iteration(s)" obscures the root cause (model not available). Already tracked in fullsend-ai/fullsend #7023.

• No re-dispatch after infrastructure failure — The review was never retried despite failing for infrastructure reasons, not code quality reasons. Already tracked in fullsend-ai/fullsend #7104.

• Retro running on trivial Dependabot PRs — This retro itself is low-value: analyzing a 2-file dependency bump where the review agent crashed and produced nothing. Skipping retro for bot-authored trivial PRs is already tracked in fullsend-ai/fullsend #3226, #4006, #3317, #3833, #3951, and several related issues.

No new proposals

No proposals are filed because all identified improvements are already covered by existing open issues. Filing new issues would create duplicates.