drizzle-team / drizzle-team/drizzle-orm

Security: Upgrade esbuild from 0.25.0 to 0.27.2 due to Go vulnerability

Open
#5,290 2 comments 10 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
35.8k
Forks
1.6k
Avg merge
2d 7h
Merged PRs (30d)
4

Description

### Description

`Drizzle-kit` currently depends on esbuild v0.25.0, which is built using a vulnerable version of Go. This introduces a potential security risk for projects consuming Drizzle ORM, especially in environments with strict security or compliance requirements. https://github.com/evanw/esbuild/issues/4362

Upgrading esbuild to v0.27.2 resolves this issue, as it is built with an updated Go version that includes security fixes.

### Impact

- Security scanners flag esbuild 0.25.0 due to its Go runtime vulnerability
- Causes CI/CD pipeline failures in security-enforced environments
- Forces consumers to use overrides / resolutions to mitigate the issue

### Requested change

- Upgrade esbuild dependency from 0.25.0 → 0.27.2
- Ensure the updated version is used across all build targets

### Why this matters

Even if esbuild is a build-time dependency, vulnerable Go binaries are often blocked by:

- Enterprise security policies
- Dependency vulnerability scanners
- Production image hardening processes

Updating esbuild would remove the need for downstream workarounds and improve overall supply-chain security.

Thank you for your time and for maintaining Drizzle ORM.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.