drizzle-team / drizzle-team/drizzle-orm
Security: Upgrade esbuild from 0.25.0 to 0.27.2 due to Go vulnerability
- Dominant language
- TypeScript
- Stars
- 35.8k
- Forks
- 1.6k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 4
Description
### Description
`Drizzle-kit` currently depends on esbuild v0.25.0, which is built using a vulnerable version of Go. This introduces a potential security risk for projects consuming Drizzle ORM, especially in environments with strict security or compliance requirements. https://github.com/evanw/esbuild/issues/4362
Upgrading esbuild to v0.27.2 resolves this issue, as it is built with an updated Go version that includes security fixes.
### Impact
- Security scanners flag esbuild 0.25.0 due to its Go runtime vulnerability
- Causes CI/CD pipeline failures in security-enforced environments
- Forces consumers to use overrides / resolutions to mitigate the issue
### Requested change
- Upgrade esbuild dependency from 0.25.0 → 0.27.2
- Ensure the updated version is used across all build targets
### Why this matters
Even if esbuild is a build-time dependency, vulnerable Go binaries are often blocked by:
- Enterprise security policies
- Dependency vulnerability scanners
- Production image hardening processes
Updating esbuild would remove the need for downstream workarounds and improve overall supply-chain security.
Thank you for your time and for maintaining Drizzle ORM.
Contributor guide
Assessment
This issue has not been assessed yet.