ilpanich / axiam-typescript-sdk / 29427399301

94%

push

github

build(deps): dedupe transitive esbuild to >=0.28.1 (GHSA-g7r4-m6w7-qqqr)

tsup@8.5.1 (the newest release) pins esbuild ^0.27.0 and pulled a nested
esbuild 0.27.7, which Dependabot flags for GHSA-g7r4-m6w7-qqqr (arbitrary
file read via esbuild's dev server on Windows, CWE-22, low). The advisory's
vulnerable path — esbuild's `serve` dev server — is never used here (tsup
only invokes esbuild's build API, and esbuild is a dev/build-time
dependency absent from the published package), so this repo is not actually
affected. Still, pin the whole tree to the patched line via an npm override
so the alert resolves and no vulnerable version ships in the dev toolchain.
Verified tsup 8.5.1 builds ESM+CJS+DTS cleanly against esbuild 0.28.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019L3EriigmCx4yxbQwcUZ69

276 of 314 branches covered (87.9%)

Branch coverage included in aggregate %.

527 of 551 relevant lines covered (95.64%)

14.49 hits per line