[DependOnMe] Bulk security fix - 3 issues

[dependonme-deriv]

Bulk Security Fix

This pull request was automatically generated by DependOnMe to fix 3 security issues at once.

Issues Fixed

• Critical: 0
• High: 1
• Medium: 1
• Low: 1

Files Modified

• package.json

AI Summary

Fixed 3 security issues:

Fixes Applied:

1. [HIGH] esbuild — Missing binary integrity verification / RCE via NPM_CONFIG_REGISTRY

   • CVE: No specific CVE listed, Dependabot advisory
   • Change: Added "esbuild": "^0.28.1" to devDependencies (direct dependency pin) and "esbuild": "^0.28.1" to overrides (forces all transitive consumers to use safe version)
   • Why override: esbuild is a transitive dependency pulled in by vite. Since upgrading vite alone may not guarantee a specific esbuild sub-version resolution, adding an overrides entry ensures npm resolves esbuild to >=0.28.1 across the entire dependency tree.

2. [LOW] esbuild — Arbitrary file read on Windows dev server

   • CVE: No specific CVE listed, Dependabot advisory
   • Change: Same fix as issue feat: add extended useQuery & APIContext #1 — esbuild pinned to ^0.28.1 covers both HIGH and LOW advisories since both require >= 0.28.1.

3. [MEDIUM] picomatch — Method Injection in POSIX Character Classes (CVE-2026-33672)

   • Change: picomatch was already at 4.0.4 in both devDependencies and overrides in the provided package.json. No change was needed in the manifest — the package-lock.json issue will be resolved upon running npm install with the existing pinned version. The override and direct dependency entries remain at 4.0.4 to enforce the safe version across the dependency tree.

What Was Changed:

Field	Before	After
devDependencies.esbuild	(not present)	"^0.28.1"
overrides.esbuild	(not present)	"^0.28.1"
devDependencies.picomatch	"4.0.4"	"4.0.4" (unchanged — already correct)
overrides.picomatch	"4.0.4"	"4.0.4" (unchanged — already correct)

⚠️ Risk Assessment:

• esbuild ^0.28.1 — Low Risk: This is a patch/minor bump within the same major version. esbuild is a build tool (not a runtime dependency), so no application code is affected. Vite 7.x is compatible with esbuild 0.28.x. The ^ range allows future patch updates within 0.x.
• picomatch 4.0.4 — No Risk: Already at the required version in the manifest; this is purely a lock file regeneration concern.

🧪 Testing Checklist:

• Run npm install to regenerate package-lock.json with the pinned versions
• Verify npm ls esbuild shows 0.28.1 or higher for all instances in the tree
• Verify npm ls picomatch shows 4.0.4 for all instances in the tree
• Run npm run build to confirm the build succeeds with the new esbuild version
• Run npm run dev to confirm the development server starts correctly
• Run npm test to ensure all tests pass
• Confirm no TypeScript compilation errors (tsc --noEmit)

🔧 Manual Steps Required:

1. After applying this package.json, run:

   npm install

2. Commit both package.json and the regenerated package-lock.json
3. Run your CI pipeline to validate the full build and test suite

---

This PR was created by DependOnMe - Automated Security Issue Management

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details

Scanned Manifest Files

package-lock.json

• esbuild@0.27.7
• @esbuild/aix-ppc64@0.28.1
• @esbuild/android-arm@0.28.1
• @esbuild/android-arm64@0.28.1
• @esbuild/android-x64@0.28.1
• @esbuild/darwin-arm64@0.28.1
• @esbuild/darwin-x64@0.28.1
• @esbuild/freebsd-arm64@0.28.1
• @esbuild/freebsd-x64@0.28.1
• @esbuild/linux-arm@0.28.1
• @esbuild/linux-arm64@0.28.1
• @esbuild/linux-ia32@0.28.1
• @esbuild/linux-loong64@0.28.1
• @esbuild/linux-mips64el@0.28.1
• @esbuild/linux-ppc64@0.28.1
• @esbuild/linux-riscv64@0.28.1
• @esbuild/linux-s390x@0.28.1
• @esbuild/linux-x64@0.28.1
• @esbuild/netbsd-arm64@0.28.1
• @esbuild/netbsd-x64@0.28.1
• @esbuild/openbsd-arm64@0.28.1
• @esbuild/openbsd-x64@0.28.1
• @esbuild/openharmony-arm64@0.28.1
• @esbuild/sunos-x64@0.28.1
• @esbuild/win32-arm64@0.28.1
• @esbuild/win32-ia32@0.28.1
• @esbuild/win32-x64@0.28.1
• esbuild@0.28.1
• @esbuild/aix-ppc64@0.27.7
• @esbuild/android-arm@0.27.7
• @esbuild/android-arm64@0.27.7
• @esbuild/android-x64@0.27.7
• @esbuild/darwin-arm64@0.27.7
• @esbuild/darwin-x64@0.27.7
• @esbuild/freebsd-arm64@0.27.7
• @esbuild/freebsd-x64@0.27.7
• @esbuild/linux-arm@0.27.7
• @esbuild/linux-arm64@0.27.7
• @esbuild/linux-ia32@0.27.7
• @esbuild/linux-loong64@0.27.7
• @esbuild/linux-mips64el@0.27.7
• @esbuild/linux-ppc64@0.27.7
• @esbuild/linux-riscv64@0.27.7
• @esbuild/linux-s390x@0.27.7
• @esbuild/linux-x64@0.27.7
• @esbuild/netbsd-arm64@0.27.7
• @esbuild/netbsd-x64@0.27.7
• @esbuild/openbsd-arm64@0.27.7
• @esbuild/openbsd-x64@0.27.7
• @esbuild/openharmony-arm64@0.27.7
• @esbuild/sunos-x64@0.27.7
• @esbuild/win32-arm64@0.27.7
• @esbuild/win32-ia32@0.27.7
• @esbuild/win32-x64@0.27.7