Bump the npm_and_yarn group across 2 directories with 1 update

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: esbuild.
Bumps the npm_and_yarn group with 1 update in the /artifacts/api-server directory: esbuild.

Updates esbuild from 0.27.3 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates esbuild from 0.27.3 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

---

Summary by cubic

Upgrade esbuild to 0.28.1 in artifacts/api-server and update the root lockfile; also apply automated code formatting across the repo. No functional changes.

• Dependencies

  • Bump esbuild from 0.27.3 to 0.28.1 and update lockfile.
  • Align peers (e.g., esbuild-plugin-pino) with esbuild@0.28.1.
  • Includes upstream fixes like Windows dev server path traversal mitigation and Deno install integrity checks.

• Refactors

  • Automated formatting with standard toolchain (no behavior changes).

^{Written for commit ffabbb7. Summary will update on new commits.}

Greptile Summary

This PR bumps esbuild from 0.27.3 to 0.28.1 across two directories, patching two security CVEs and several bug fixes. The lockfile consistently updates all dependents and tsx gets an incidental bump to 4.22.4.

Confidence Score: 5/5

Safe to merge — this is a targeted security patch with no API-breaking changes for the usage patterns in this repo.

The bump closes two published security advisories in esbuild's dev server and Deno install script. The esbuild 0.27→0.28 range contains only bug fixes and no breaking changes to the build API. The indirect tsx bump (4.21→4.22) is a minor patch. All lockfile changes are consistent and the old tsx snapshot is legitimately retained for other dependents.

No files require special attention. The recharts@2.15.4 deprecation surfaced in the lockfile is worth a separate follow-up but is unrelated to this change.

Important Files Changed

Filename	Overview
artifacts/api-server/package.json	Bumps esbuild dev dependency from ^0.27.3 to ^0.28.1; straightforward version constraint update.
pnpm-lock.yaml	Lockfile reflects esbuild 0.27.3→0.28.1, tsx 4.21.0→4.22.4 (indirect via vite), and a new recharts deprecation notice; tsx@4.21.0 snapshot is still present (used elsewhere) but now references esbuild@0.28.1.

_{Reviews (1): Last reviewed commit: "style: format code with ClangFormat, dot..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tools	Error		Jun 12, 2026 8:16pm

[cr-gpt]

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
pnpm-lock.yaml	100% smaller
artifacts/api-server/package.json	0% smaller

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	tools	ffabbb7	Jun 12 2026, 08:16 PM

[codeant-ai]

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

[difflens]

View changes in DiffLens

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

pnpm-lock.yaml

Package	Version	License	Issue Type
tsx	4.22.4	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/esbuild	^0.28.1	Unknown	Unknown
npm/@esbuild/linux-x64	0.28.1	🟢 4.2	Details Check Score Reason Code-Review ⚠️ 0 Found 1/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/esbuild	0.28.1	🟢 4.2	Details Check Score Reason Code-Review ⚠️ 0 Found 1/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/tsx	4.22.4	Unknown	Unknown

Scanned Files

• artifacts/api-server/package.json
• pnpm-lock.yaml

[difflens]

View changes in DiffLens

[difflens]

View changes in DiffLens

[difflens]

View changes in DiffLens

[guardrails]

⚠️ We detected 3 security issues in this pull request:

Hard-Coded Secrets (1)

Severity	Details	Docs
Medium	Title: Secret Keyword Tools/artifacts/personal-tool-console/src/pages/home.tsx Line 12 in ffabbb7 passwordMode: 'strong',	📚

More info on how to fix Hard-Coded Secrets in General.

---

Insecure Processing of Data (2)

Severity	Details	Docs
Medium	Title: Unescaped user input in React dangerouslySetInnerHTML Tools/artifacts/mockup-sandbox/src/components/ui/chart.tsx Line 94 in ffabbb7 .join("\n"),	📚
Medium	Title: Unescaped user input in React dangerouslySetInnerHTML Tools/artifacts/personal-tool-console/src/components/ui/chart.tsx Line 95 in ffabbb7 .join("\n"),	📚

More info on how to fix Insecure Processing of Data in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	esbuild@​0.28.1

View full report

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

📝 Info: esbuild 0.x minor version bump may contain breaking changes

Under semver for 0.x versions, the caret (^) only allows patch-level changes (e.g., ^0.28.1 matches >=0.28.1, <0.29.0), so this is effectively a controlled upgrade within the 0.28 range. However, esbuild treats minor version bumps in the 0.x series as potentially breaking. The build script at artifacts/api-server/build.mjs uses only stable, well-established API options (entryPoints, platform, bundle, format, outdir, outExtension, logLevel, external, sourcemap, plugins, banner), so the risk is low. Still, it's worth confirming the build succeeds with the new version, especially the esbuild-plugin-pino plugin compatibility.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[codescene-delta-analysis]

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: Customizable Safeguards
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[difflens]

View changes in DiffLens

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[deepsource-io]

DeepSource Code Review

We reviewed changes in 90cc400...ffabbb7 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Scala		Jun 12, 2026 8:16p.m.	Review ↗
Swift		Jun 12, 2026 8:16p.m.	Review ↗
JavaScript		Jun 12, 2026 8:16p.m.	Review ↗
Ruby		Jun 12, 2026 8:16p.m.	Review ↗
C & C++		Jun 12, 2026 8:16p.m.	Review ↗
C#		Jun 12, 2026 8:16p.m.	Review ↗
Rust		Jun 12, 2026 8:16p.m.	Review ↗
Shell		Jun 12, 2026 8:16p.m.	Review ↗
Terraform		Jun 12, 2026 8:16p.m.	Review ↗
Code coverage		Jun 12, 2026 8:16p.m.	Review ↗
SQL		Jun 12, 2026 8:16p.m.	Review ↗
Secrets		Jun 12, 2026 8:16p.m.	Review ↗
Ansible		Jun 12, 2026 8:16p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[greptile-apps]

Recharts v2 deprecated — unrelated to this bump

The lockfile now surfaces a deprecation notice for recharts@2.15.4: the 1.x/2.x branches are no longer active and maintainers recommend upgrading to v3. This isn't introduced by the esbuild bump, but the notice appearing here makes it easy to miss. If recharts is used in the project, tracking an upgrade to v3 is worth a follow-up.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[difflens]

View changes in DiffLens

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This PR is a Dependabot-driven update of esbuild from 0.27.3 to 0.28.1. The changes are limited to:

1. artifacts/api-server/package.json - Dependency version bump
2. pnpm-lock.yaml - Auto-generated lockfile and formatting updates

Security Improvements in esbuild 0.28.1:

• GHSA-g7r4-m6w7-qqqr: Fixes path traversal vulnerability in local development server on Windows (disallows \ backslash in HTTP requests)
• GHSA-gv7w-rqvm-qjhr: Adds integrity checks to the Deno API installation
• Additional bug fixes for module evaluation and minifier edge cases

The lockfile formatting changes (single to double quotes) are auto-generated by pnpm and do not affect functionality.

Files Reviewed (2 files)

• artifacts/api-server/package.json - No issues (dependency version update only)
• pnpm-lock.yaml - No issues (auto-generated lockfile update)

---

_{Reviewed by laguna-m.1-20260312:free · 438,756 tokens}

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 medium

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Security	1 medium

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[llamapreview]

AI Code Review by LlamaPReview

🎯 TL;DR & Recommendation

Recommendation: Approve with suggestions

This PR bumps esbuild to 0.28.1 across two directories, addressing two security advisories. However, the lockfile was also reformatted by external tools, which could lead to merge conflicts or parsing issues; it's recommended to regenerate it using pnpm.

💡 Suggestions (P2)

• artifacts/api-server/package.json: Esbuild bump is fine, but the lockfile was reformatted by external tools, risking merge conflicts and potential YAML parsing issues. Run pnpm install to regenerate.

---

💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.

[llamapreview]

P2 | Confidence: Medium

The esbuild dependency is bumped from ^0.27.3 to ^0.28.1. This is a minor version bump in a 0.x release line, which per semver conventions may include breaking changes. The release notes for 0.28.1 list only bug fixes and security patches (e.g., corrected handling of using declarations, module evaluation errors, and new operator edge cases) without explicitly stating any breaking changes. However, these fixes can alter build output semantics (e.g., minification of using blocks now correctly preserves resource disposal).

The lockfile (pnpm-lock.yaml) was also updated to reflect the new version and additionally went through an automated reformatting pass (commit ffabbb7) by tools like Prettier. Reformatting a package lockfile with external tools is non‑standard; pnpm expects a specific structure (two‑space indentation). While the lockfile may still be valid, this practice increases the risk of merge conflicts and could potentially cause silent parsing issues if the formatting deviates from what pnpm’s YAML parser expects.

Impacts path:pnpm-lock.yaml because the lockfile was reformatted, not just version‑updated. The esbuild update itself includes two security advisories (GHSA‑g7r4‑m6w7‑qqqr and GHSA‑gv7w‑rqvm‑qjhr) which is beneficial. Recommend verifying the build output and running the full test suite after merging, and regenerating the lockfile via pnpm install to avoid formatting‑related risks.

[cr-gpt]

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information