[miguel-heygen]

What

Update esbuild to 0.28.x (the same version bumps as #5152) and regenerate the committed media-use SVG sanitizer bundle with it.

Why

Older esbuild releases have a path traversal in the development server on Windows. This repo does not use esbuild's dev server, so the exposure is low, but the advisory is open and the bump is small.

#5152 makes this change but cannot merge as it is: packages/cli/src/media-use/lib/svg-sanitize.mjs is a committed esbuild bundle, so the new esbuild produces different bytes and the required "Test (support)" check fails on scripts/check-media-use-svg-sanitize-generated.test.mjs. The bot will not regenerate it. This PR carries the same version changes plus the regenerated file, so it supersedes #5152.

Related work

Supersedes #5152.

How

The manifest, lockfile and registry block changes are exactly #5152's diff applied to current main. Then node scripts/generate-media-use-svg-sanitize.mjs regenerated the bundle, which changes four lines.

Test plan

• node --test scripts/check-media-use-svg-sanitize-generated.test.mjs passes after regeneration (it fails with only the version bump).
• Lockfile installs with bun install --frozen-lockfile.
• Unit tests added/updated
• Manual testing performed
• Documentation updated (if applicable)

No visible change

Dependency manifests and a generated bundle only. No Studio or player behavior changes.

[github-actions]

Edit accuracy: accurate 271 (base branch 271), smooth 122 of those

The gate passes.
Smoothness is reported in the artifact, not gated. A case fails only if it fails 2 of 3 runs.

Quarantined, measured but not gated (0)

Unstable (1)

• seqplainkeys-none-center-r0-root-z100: tracking 0.06, pressJump 0, drop 0, reload 0, render 0.03, renderKey -, undo false, teleport true / tracking 0.06, pressJump 0, drop 0, reload 0, render 0.03, renderKey -, undo true, teleport true / tracking 0.06, pressJump 0, drop 0, reload 0, render 0.03, renderKey -, undo true, teleport true

[heygengenesis]

Verdict: APPROVE · 0 blocker · 0 important · 1 nit · head a35714bb

• nit: packages/cli/package.json ships esbuild as a runtime dependency. esbuild 0.27.0 moved to Go 1.25, which needs macOS 12 or later, while Node 22 (the CLI's engines floor) still runs on macOS 11. The CLI's esbuild step would stop working for anyone left on macOS 11. That is a tiny group, but a changelog line would cover it.

Scope

Diffed the regenerated svg-sanitize.mjs bundle word by word against the base. The output differs in two places, both changes in how esbuild writes its own helper code, and they behave the same. None of the sanitizer's logic changed. The bun.lock changes beyond esbuild re-sync the workspace versions (0.8.169 → 0.8.194) and add the inspector bin, which packages/inspector/package.json already declares. The manifest bumps match #5152. The 0.26–0.28 changelogs list no API changes, only trusted publishing, Go toolchain updates and fallback-download integrity checks. CI is green on this head.