fix: [M3-9438] - ESBuild Vulnerability

[bill-akamai]

Description 📝

This PR addresses a security vulnerability in esbuild that allows any website to send requests to the development server and read the response due to default CORS settings. https://github.com/linode/design-language-system/security/dependabot/46

Major Changes 🔄

• Added resolution in package.json to enforce esbuild 0.25.0+

[bill-akamai]

@abailly-akamai would we also want to bump the version of this repo to "version": "4.0.1" to reflect this security fix?

[abailly-akamai]

@bill-akamai Have you gone through the dependency tree before adding a resolution? Usually a resolution is the very last recourse (they are hard to manage and easy to forget) and updating a parent package is preferred when possible. It may or not may not blow up the scope, but we ought to explore that option first.

[bill-akamai]

@abailly-akamai Understood. Running yarn up on the relevant packages (vite, tsup, storybook) was only partially successful in upgrading their esbuild dependecies to 0.25.0:

bcoloe@dfw-mp0f2 design-language-system % yarn why esbuild
├─ @storybook/core@npm:8.4.7
│  └─ esbuild@npm:0.24.2 (via npm:^0.18.0 || ^0.19.0 || ^0.20.0 || ^0.21.0 || ^0.22.0 || ^0.23.0 || ^0.24.0)
│
├─ @storybook/core@npm:8.4.7 [4ac60]
│  └─ esbuild@npm:0.24.2 (via npm:^0.18.0 || ^0.19.0 || ^0.20.0 || ^0.21.0 || ^0.22.0 || ^0.23.0 || ^0.24.0)
│
├─ tsup@npm:8.4.0
│  └─ esbuild@npm:0.25.0 (via npm:^0.25.0)
│
├─ tsup@npm:8.4.0 [d3936]
│  └─ esbuild@npm:0.25.0 (via npm:^0.25.0)
│
├─ vite@npm:6.1.1
│  └─ esbuild@npm:0.24.2 (via npm:^0.24.2)
│
├─ vite@npm:6.2.0
│  └─ esbuild@npm:0.25.0 (via npm:^0.25.0)
│
├─ vite@npm:6.1.1 [29ffd]
│  └─ esbuild@npm:0.24.2 (via npm:^0.24.2)
│
├─ vite@npm:6.2.0 [d3936]
│  └─ esbuild@npm:0.25.0 (via npm:^0.25.0)
│
└─ vite@npm:6.1.1 [ee5a6]
   └─ esbuild@npm:0.24.2 (via npm:^0.24.2)

So I suppose our options are to:

1. Use a resolution (admittedly, I don't know hard hard it is to manage these if they produce incompatibility issues)
   or
2. Periodically upgrade parent packages individually until they all use esbuild 0.25.0.

Sounds like option 2 is safer albeit more drawn out. What do you think?