deps: bump esbuild from 0.25.12 to 0.28.2 in /packages/squad-cli in the minor-patch group across 1 directory

[dependabot]

Bumps the minor-patch group with 1 update in the /packages/squad-cli directory: esbuild.

Updates esbuild from 0.25.12 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

• Allow import path specifiers starting with #/ (#4361)

  Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

  This change was contributed by @​hybrist.

• Automatically add the -webkit-mask prefix (#4357, #4358)

  This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

  /* Original code */
  main {
    mask: url(x.png) center/5rem no-repeat
  }
  /* Old output (with --target=chrome110) */
  main {
  mask: url(x.png) center/5rem no-repeat;
  }
  /* New output (with --target=chrome110) */
  main {
  -webkit-mask: url(x.png) center/5rem no-repeat;
  mask: url(x.png) center/5rem no-repeat;
  }

  This change was contributed by @​BPJEnnova.

• Additional minification of switch statements (#4176, #4359)

  This release contains additional minification patterns for reducing switch statements. Here is an example:

  // Original code
  switch (x) {
    case 0:
      foo()
      break
    case 1:
    default:
      bar()
  }

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.

[dependabot]

Labels

The following labels could not be found: dependencies, squad:belanna. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[DeDuva]

Not merged — needs refresh: workspace lockfile drift (head 29b5e5a9)

This PR changes packages/squad-cli/package.json and nothing else. This is an npm-workspaces monorepo with a single root package-lock.json, so the manifest and the lockfile disagree: npm ci refuses to install, and any green check on this head is green for the old esbuild.

GitHub reports this PR as mergeable: true, mergeStateStatus: clean, and test shows SUCCESS — none of which is evidence that esbuild 0.28.2 was actually exercised, because the lockfile still pins 0.25.12.

Asking Dependabot to rebuild the update so the root lockfile moves with the manifest:

·@·d·ependabot r·ecreate

Even once refreshed, this one is human review, not an automatic merge. Two reasons compound:

1. It is effectively a major. Under semver a 0.x minor bump is breaking, so esbuild 0.25.12 → 0.28.2 — three minor lines — gets major-level scrutiny, not the minor-tier treatment its group label implies.
2. It is a bundler. Toolchain upgrades that change compiler or bundler behaviour surface their failures at publish time and in downstream consumers, not in this repository's test run, so green CI here is not sufficient evidence for them.

Worth checking before taking it: esbuild's changelog across 0.26, 0.27, and 0.28 for output/target changes, and whether packages/squad-cli's build output still matches what the published package expects.

[DeDuva]

Superseded by #135 — closing.

The upgrade this PR wanted is now on dev: packages/squad-cli/package.json has "esbuild": "^0.28.2", landed together with the matching root package-lock.json.

This PR could never have merged as it stood. It changed packages/squad-cli/package.json and nothing else, but squad-cli is a member of workspaces: packages/* with no lockfile of its own, so the manifest and the single root lockfile disagreed and npm ci refused with EUSAGE — Missing: esbuild@0.28.2 from lock file. That it nonetheless reported MERGEABLE/CLEAN is because the test job runs npm install, not npm ci, so nothing in CI ever checked the lockfile.

The /packages/squad-cli entry in dependabot.yml that produced this shape has been removed in #135; the root / entry updates member manifests and the lockfile together.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml