chore(deps): bump esbuild ^0.25.0 -> ^0.28.1 (fixes SNYK-JS-ESBUILD-17750822)

[juar-queue-it]

Summary

Bumps the esbuild dependency from ^0.25.0 to ^0.28.1.

The pinned ^0.25.0 range keeps esbuild on 0.25.x, which is flagged by Snyk as SNYK-JS-ESBUILD-17750822 — "Resources Downloaded over Insecure Protocol" (CWE-426, CVSS 9.2). The advisory covers >=0.17.0 <0.28.1 and is fixed in 0.28.1. Because the range is ^0.25.0, downstream consumers cannot pull the fix without an override — Snyk reports "no remediation path available" until @fastly/js-compute bumps it here.

esbuild is only used in the JS bundler step of the CLI (src/compiler-steps/bundle.ts and the two src/esbuild-plugins/*), so this has no effect on the StarlingMonkey/Wasm runtime.

Verification

With esbuild@0.28.1 installed:

• npx tsc (build:cli) — passes
• npm run test:types (tsd) — passes
• Ran a real build() through both Fastly plugins (fastlyPlugin + swallowTopLevelExportsPlugin) against a sample app: fastly:* imports resolve correctly and top-level exports are swallowed as expected.

The esbuild API surface used here (build({...}) plus the onResolve/onLoad plugin hooks) is unchanged across 0.25 → 0.28, so no source changes were required.

🤖 Generated with Claude Code

[juar-queue-it]

Hi everyone. I'm bumping up the dependency to esbuild as our vulnerability scanner detected a critical issue with the version you are using here.

[zkat]

replaced by #1506