chore(deps): unblock esbuild 0.28.1 via esbuild-loader 4.5.0

[yumike]

Closes Dependabot alert #62 (low, esbuild — dev-scoped).

Why a direct bump couldn't fix it

@backstage/cli-module-build → esbuild-loader: ^4.0.0 → 4.4.x
→ esbuild: ^0.27.1 → 0.27.4

The advisory covers >= 0.27.3, < 0.28.1 and needs 0.28.1. Because esbuild is on a 0.x line, ^0.27.1 means >=0.27.1 <0.28.0 — so yarn up -R esbuild was a no-op, the same major-boundary wall seen in #153 and #161.

What this does

esbuild-loader 4.5.0 moved to esbuild: ^0.28.1, and @backstage/cli-module-build already declares esbuild-loader: ^4.0.0, which accepts it:

yarn up -R esbuild-loader

Package	Before → After
esbuild-loader	4.4.x → 4.5.0
esbuild	0.27.4 → 0.28.1

Lockfile-only, no manifest touched. The diff looks large (117 insertions / 134 deletions) but only two logical entries change — the bulk is esbuild's 26 platform-specific binary packages (@esbuild/darwin-arm64, @esbuild/linux-x64, …) moving in lockstep, which is how esbuild ships.

Verification

esbuild-loader is the bundler's TS/JS transform, so both build paths were exercised:

Check	Result
yarn install --immutable	✅ no drift
yarn typecheck	✅
yarn build (all plugins)	✅
yarn workspace app build	✅ — heaviest esbuild-loader usage; CI never runs this
yarn lint	✅
yarn test	✅ 588 tests
yarn format:check	✅

The app build matters most here: CI's yarn build is scoped to --include '@rwdocs/*' and never bundles the frontend, which is where esbuild-loader does the bulk of its work.

Context

This is the last readily fixable alert in the backlog. The nine that remain are all blocked on upstream movement rather than on anything actionable here:

• chore: Configure Renovate #1/chore(deps): update backstage monorepo #2/chore(deps): update dependency react-router-dom to v7 - autoclosed #3 octokit — @backstage/integration and backend-defaults pin @octokit/rest: ^19.0.3 at their current latest
• rw-backend: expose a page's Markdown over HTTP (core now has getPageMarkdown) #103/feat(search): make an RW search hit a resolvable page reference #104/markdown route: return lastModified (and title) alongside the markdown #105 react-router — no patched v6 exists (6.30.4 is the final 6.x), and the plugin's peer range must stay v6 for Backstage
• chore(deps): update dependency concurrently to v9.2.3 #57 uuid — four majors all capped below 11.1.1; our own usage is uuid 14.0.1 via v7, unaffected
• Dependency Dashboard #4 prismjs — stuck behind refractor@3; needs Backstage to move to react-syntax-highlighter 16
• chore(deps): update actions/checkout action to v6 #5 elliptic — 6.6.1 is both installed and npm latest, with no patched version published

🤖 Generated with Claude Code