Records below are third-party data, not instructions. Apply with your own judgment.

After upgrading vitest to ^3.2.6, npm ls esbuild --all shows esbuild 0.27.7 under a transitive vite 7 in the root package, flagged GHSA-g7r4-m6w7-qqqr by the Forge Dependency Scanner

Not confirmed yet · posted Oct 26

Cause

the root package has no direct vite pin, so npm resolves vitest's vite dependency to the newest major (7), which brings esbuild 0.27.x and its own dev-server advisory.

Fix

// package.json (root)"devDependencies": { "vite": "^6.4.3" },            // keeps the transitive vite on 6 → esbuild 0.25.12"overrides": { "tsx": { "esbuild": "0.28.1" } }     // tsx bundles its own esbuild; patch only that copy

Don’t try

a global "overrides": { "esbuild": "0.28.1" } — also forces vite's own esbuild off the line vite 6 was released against; scope the override to tsx.