fix: upgrade esbuild to ~0.25.0 to address vuln report

[RobinTail]

Fixes GHSA-67mh-4wv8-2f99

https://github.com/evanw/esbuild/releases/tag/v0.25.0

I ran the tests manually and they succeeded.

[RobinTail]

@privatenumber , please review

[nwalters512]

While I do want tsx to upgrade esbuild so that I can avoid duplicates in my own dependency tree, it's worth noting that tsx isn't impacted by the vulnerability reported in esbuild. tsx only uses esbuild's transformation API, it doesn't use the development server.

[LukeNotable]

How about specifying a broader range like >= 0.22.0 < 0.26.0 to support the latest without requiring everyone to upgrade through potentially breaking changes (if that's a concern)?

[casewalker]

@LukeNotable Sadly, that's kind of out of tsx's hands. Semver breaks down for versions < 1.0.0, and even though it is a little more than 5 years old, esbuild has not yet decided to go from from versions 0.y.z to an official released 1.0.0 version yet. Since there are no guarantees pre-1.0.0, tsx cannot trust that there won't be breaking changes even in the next patch version, i.e. 0.25.1. I find that pretty frustrating, so I just left a comment over there asking that esbuild reconsider their versioning strategy.

[tats-u]

Even though it's true tsx itself isn't affected by this vulnerability, no one can imagine the culprit that emitted security alerts in projects is tsx.

[tats-u]

@privatenumber Changes in 0.24:

https://github.com/evanw/esbuild/releases/tag/v0.24.0

None of them or those in 0.25 affect on tsx, right?

[shinebayar-g]

tsx cannot trust that there won't be breaking changes even in the next patch version, i.e. 0.25.1.

Small correction. Before 1.0.0, Major = Minor. So patch versions should NOT introduce breaking changes, but minor versions can.

[casewalker]

@shinebayar-g No, that's not how SemVer is defined. If you clicked the link I shared before, it says:

Major version zero (0.y.z) is for initial development. Anything MAY change at any time.

It doesn't say breaking changes are restricted to only minor version increases, it says anything may change at any time.

It may be true that some projects treat the Minor and Patch versions in this down-shifted way which you describe, and I agree it is super helpful when they do, but SemVer does not guarantee that.

[shinebayar-g]

Fair.

[luhn]

tsx cannot trust that there won't be breaking changes even in the next patch version, i.e. 0.25.1

But tsx is already trusting this, it currently depends on esbuild ~0.23.0 which includes 0.23.1 and any possible future patch versions.

[luhn]

My point is that tsx is already assuming that patch releases are backwards compatible, so if 0.25.0 passes muster then <0.26 is a valid constraint

[tats-u]

It depends on the packages. However esbuild doesn't seem to contaminate patch updates with breaking changes.
The current content of this PR is the best.

If someone insists that esbuild brings breaking changes even to patch updates, they must paste a link to the change log of one of versions other than 0.x.0 that included breaking changes here.

[naile]

Are there plans on merging this soon? Would be nice to get rid of this from our vulnerability reports.

[privatenumber]

This issue is now resolved in v4.19.3.

If you're able to, your sponsorship would be very much appreciated.