fix(deps): force esbuild >=0.28.1 (Dependabot alert #5, GHSA-gv7w-rqvm-qjhr)

[wolpert]

Resolves Dependabot alert #5.

The alert

• Package: esbuild 0.27.7 — transitive, dev-only (pulled by tsup and vitest→vite), in clients/passkeys-browser.
• Advisory: GHSA-gv7w-rqvm-qjhr (HIGH) — missing binary integrity verification in esbuild's Deno module enables RCE via NPM_CONFIG_REGISTRY. First patched in 0.28.1.

Real-world risk here: low, but worth clearing

• esbuild is a build-time bundler — it's never part of the published @pk-auth/passkeys-browser bundle, so SDK consumers are not exposed.
• The advisory is specific to esbuild's Deno module; this repo uses esbuild via Node (tsup/vite), so the exploit path doesn't apply.
• Still a HIGH advisory and a one-line fix, so we clear it (keeps the dependency-review gate and the security tab clean).

The fix

Add an npm overrides entry pinning esbuild to ^0.28.1. Both tsup and vite now resolve to 0.28.1 (verified via npm ls esbuild).

"overrides": { "esbuild": "^0.28.1" }

Verification

• npm ls esbuild → single 0.28.1, deduped across tsup + vite.
• tsc --noEmit clean; tsup builds ESM/CJS/DTS; 76/76 vitest tests pass.
• npm audit → no remaining high-severity issues.

Note: npm audit still reports 2 moderate issues via typed-rest-client→qs (separate dev-tooling chain, not this alert). Happy to address those in a follow-up if you want.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud