Support esbuild@0.22

[sxzz]

Acknowledgements

• [X] I read the documentation and searched existing issues to avoid duplicates
• [X] I understand this is a bug tracker and anything other than a proven bug will be closed
• [X] I understand this is a free project and relies on community contributions
• [X] I read and understood the Contribution guide

Minimal reproduction URL

N/A

Problem & expected behavior (under 200 words)

esbuild v0.22 has been released with some breaking changes.

The new version no longer supports Windows 7/8. Should we upgrade now and release a major version?

Bugs are expected to be fixed by those affected by it

• [X] I'm interested in working on this issue

Compensating engineering work will speed up resolution and support the project

• [ ] I'm willing to offer $10 for financial support

[privatenumber]

Is there a particular motivation? (e.g. a feature or fix you want from the release?)

[sxzz]

There doesn't seem to be any benefit for tsx, but for the codebase, it means one less version of dependency to install 😜

[langchain-infra]

the old esbuild version also has a critical go vuln: see this issue https://github.com/evanw/esbuild/issues/3802.

[privatenumber]

The response from the maintainer in that thread explains how that vulnerability report is a false alarm for esbuild.

(Am I missing something?)

[langchain-infra]

Yes agreed it doesn't actually impact production applications but would be nice to not have to explicitly whitelist the vuln(since its critical) as it shows up on a lot of scanners.

[privatenumber]

This seems off topic now as it's a false problem coming from your scanner.

Please file an issue with your scanner instead. They should not be blindly flagging projects without auditing the scope of impact.

Hiding these comments as they're not practical motivations for upgrading.