[Eugene (OEvgeny)]

Clears Dependabot alert GHSA-g7r4-m6w7-qqqr (low, development only): tsup@8 resolves esbuild@0.27.7.

Changelog Entry

Changed

• Bumped tsup@9.0.0 and esbuild@0.28.2; building Web Chat needs Node.js 22.18, 24.11 or later, in PR #6023, by @OEvgeny

Description

Bumps tsup to 9.0.0 (esbuild@0.28.2, rollup@4.66.0). Building Web Chat now needs Node.js 22.18, 24.11 or later (CI uses 24).

Design

• Options: (a) keep 8.x and dismiss the alert, as it only affects esbuild's dev server, which we don't run; (b) chosen: bump, the output stays equivalent. Overriding esbuild under tsup@8 would ship the same helpers on a pair tsup 8 does not declare.
• JavaScript: every changed file is identical after undoing esbuild 0.28's __commonJS/__esm helpers (a failed module init throws again instead of returning partial exports), local renames and chunk names; +0.2–5 KB per package. Our static/ build and repacked dependencies already ship these helpers (esbuild@0.28.1).
• Typings: the 2,422 exported names and kinds of all published entry points, namespace members included, are identical; only the file layout changes (export type { X }, chunks). A consumer tsc (skipLibCheck: false, TypeScript 5.9 and 6.0) matches main.

Specific Changes

• package.json (root and 5 workspaces): tsup@^9.0.0

• package-lock.json: tsup and its dependencies (plus rollup's optional @napi-rs/lzma-linux-x64-gnu); the nested esbuild@0.28.1 of 16 workspaces dedupes to the root esbuild@0.28.2

• I have added tests and executed them locally

• I have added .changelog/<PR#>-<slug>.md

• I have updated documentation

Review Checklist

This section is for contributors to review your work.

• Accessibility reviewed (tab order, content readability, alt text, color contrast)
• Browser and platform compatibilities reviewed
• CSS styles reviewed (minimal rules, no z-index)
• Documents reviewed (docs, samples, live demo)
• Internationalization reviewed (strings, unit formatting)
• package.json and package-lock.json reviewed
• Security reviewed (no data URIs, check for nonce leak)
• Tests reviewed (coverage, legitimacy)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.