From 1b5b65e708240644e7a384d876588b891de97230 Mon Sep 17 00:00:00 2001 From: Vladimir Kutepov Date: Sun, 12 Apr 2026 15:07:41 +0700 Subject: [PATCH] fix: move esbuild to devDependencies esbuild is only imported in build-time Vite plugin code (src/config/fs-routes/router.ts) and is never used by the production server output. Having it in dependencies causes unnecessary Docker image bloat (~9MB Go binary) and false-positive security scanner findings (Go stdlib CVEs in the esbuild binary). Closes #2135 Co-Authored-By: Claude Opus 4.6 (1M context) --- packages/start/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/start/package.json b/packages/start/package.json index e3f75341e..76ca10199 100644 --- a/packages/start/package.json +++ b/packages/start/package.json @@ -47,7 +47,6 @@ "defu": "^6.1.4", "error-stack-parser": "^2.1.4", "es-module-lexer": "^2.0.0", - "esbuild": "^0.27.4", "fast-glob": "^3.3.3", "h3": "2.0.1-rc.16", "html-to-image": "^1.11.13", @@ -68,6 +67,7 @@ "node": ">=22" }, "devDependencies": { + "esbuild": "^0.27.4", "@types/babel__core": "^7.20.5", "@types/node": "^25.5.0", "vite": "^7.3.1",