From d309914d8f2ca25214f0eb1862c192ef16bd8605 Mon Sep 17 00:00:00 2001
From: teamchong <25894545+teamchong@users.noreply.github.com>
Date: Wed, 20 May 2026 09:22:22 -0400
Subject: [PATCH] =?UTF-8?q?chore(deps):=20bump=20esbuild=200.21.5=20?=
 =?UTF-8?q?=E2=86=92=200.28.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses GHSA-67mh-4wv8-2f99 (esbuild dev server allowed any website
to send requests and read responses, patched in ≥0.25.0). Dev-only —
we use esbuild as the bundler in scripts/build.mjs, never as a server.

Build, typecheck, and 273 tests all clean.
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 16d86d5..ea71a39 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
     "@cloudflare/workers-types": "^4.20240512.0",
     "@napi-rs/canvas": "^0.1.53",
     "@types/node": "^20.12.0",
-    "esbuild": "^0.21.0",
+    "esbuild": "^0.28.0",
     "tsx": "^4.10.0",
     "typescript": "^5.4.0",
     "vitest": "^1.6.0",