build: upgrade esbuild to 0.28 and tsx to 4

[nealrichardson]

Phase 0.3 of the dependency upgrade.

Changes

esbuild 0.16.17 → 0.28.2 (packages/build/src/index.ts)

• Watch mode: esbuild 0.17 removed watch/onRebuild (it rejects even watch: false), so dev mode now uses context() + ctx.watch(), with a small onEnd plugin that logs [watch] build finished / failed. Non-dev builds still call build(). Two behavior changes in yarn dev-vscode:
  • A failed initial build keeps watching instead of exiting.
  • Since esbuild 0.25, a failed rebuild deletes out/main.js until the error is fixed.
• Explicit target: 'node22': since 0.18, esbuild no longer reads target from tsconfig.json. Without an explicit value, the bundles would be un-lowered esnext. node22 is the Node in VS Code 1.101, the engines.vscode floor we decided on (the manifest bump is still to come). The previous effective targets were ES2019–ES2021, taken per file from tsconfig. All of them are below Node 22, so this doesn't lower the syntax floor for any host we support.
• Where esbuild is declared: it's now a dependency of packages/build, which is the only workspace that imports it. I removed it from apps/vscode and apps/lsp, which don't import it.
• Removed esbuild-plugin-copy and replaced it with a small inline copy-assets plugin, using the built-in fs.promises.glob and no new dependencies. The package has been unmaintained since 2023, and its old chokidar/globby chain carries picomatch/braces/micromatch advisories. Once esbuild became a runtime dependency of packages/build, Snyk flagged that chain, because @quarto/_json-validator depends on build. The copied LSP assets are byte-identical to what the plugin produced.

tsx → ^4.23.15 everywhere (it was 3.12 in apps/vscode/apps/lsp and 4.7 in the packages). tsx and packages/build now resolve one shared esbuild 0.28 copy, and the deprecated @esbuild-kit/* loaders are gone from the lockfile. The only other esbuild left is 0.15, from vite 3.

apps/lsp/build.ts: removed the asset entry for ./src/run.js, which doesn't exist, so it never copied anything. Fixes #1140.

Verification

• yarn build --force: 14/14 tasks.
• Compared with main:
  • out/main.js: 4,568,904 → 4,565,143 bytes
  • out/lsp/lsp.js: 3,282,709 → 3,269,173 bytes
  • out/lsp/: identical file list (25 files, including the sqlite .wasm and resources/**)
• yarn audit --groups dependencies: no advisories reachable through build
• LSP dev watch copies the assets too (the same files, plus lsp.js.map)
• node --check passes on both bundles under Node 22.15.1 (the VS Code 1.101 floor).
• Dev watch (tsx build.ts dev): both watchers start. An edit triggers a rebuild, and a syntax error prints once and logs [watch] build failed. After the fix it rebuilds and out/main.js comes back.
• yarn build-lang: no diff under syntaxes/. This covers tsx 4's CJS require() of .ts.
• yarn test-packages: 8/8 tasks.
• yarn test-vscode (VS Code 1.109, Quarto CLI on PATH):
  • main: 150 passing
  • r-project: Workspace Symbols - R Project fails intermittently. I reproduced that on main (1 of 3 full runs), so it's pre-existing and unrelated.
• yarn lint --continue: unchanged from main (the 6 pre-existing quarto-lsp no-unused-vars errors).
• Not yet done: a manual smoke test in the Extension Development Host (LSP hover/completions, math preview, Zotero, visual editor).

🤖 Generated with Claude Code

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.