Security: drizzle-kit ships vulnerable esbuild versions and deprecated @esbuild-kit packages

# Security: drizzle-kit ships vulnerable esbuild versions and deprecated @esbuild-kit packages

**Related**: #5290 (open since Jan 2026, no labels, no assignees, no response from maintainers)

## Summary

`drizzle-kit@0.31.9` introduces **two known security vulnerabilities** into every project that depends on it, via outdated and deprecated transitive dependencies. Despite #5290 raising this concern months ago, the issue remains unaddressed with no labels, no assignees, and no timeline — while the vulnerability surface has only grown wider with the release of Vite 8.

## Vulnerabilities

### 1. esbuild@0.18.20 — GHSA-67mh-4wv8-2f99 (CORS misconfiguration)

`drizzle-kit` depends on the **deprecated** `@esbuild-kit/esm-loader@2.6.5` → `@esbuild-kit/core-utils@3.3.2`, which pulls in `esbuild@0.18.20`.

This version is affected by [GHSA-67mh-4wv8-2f99](https://osv.dev/GHSA-67mh-4wv8-2f99):

> esbuild sets `Access-Control-Allow-Origin: *` header on all requests, including the SSE connection, which allows any website to send arbitrary requests to the development server and read the response.

The `@esbuild-kit` ecosystem has been **abandoned by its author** in favor of `tsx`. These packages will never receive security patches.

### 2. esbuild@0.25.12 — Vulnerable Go runtime (CVE-2025-22871 and others)

`drizzle-kit` directly depends on `esbuild@^0.25.x`, which is built with a Go version affected by multiple CVEs including [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) (HTTP request smuggling via `net/http`). See [evanw/esbuild#4362](https://github.com/evanw/esbuild/issues/4362) for details.

This also conflicts with **Vite 8**'s peer dependency requirement of `esbuild@^0.27.0`, producing warnings on every install:

```
├─┬ vite 8.0.0
│ └── ✕ unmet peer esbuild@^0.27.0: found 0.25.12
```

## Result: 3 copies of esbuild in the dependency tree

```
esbuild@0.18.20 ← drizzle-kit → @esbuild-kit (deprecated, GHSA-67mh-4wv8-2f99)
esbuild@0.25.12 ← drizzle-kit (direct) + esbuild-register (vulnerable Go runtime)
esbuild@0.27.4 ← tsx (up to date, no known vulnerabilities)
```

## Impact

- **Security scanners flag the project** — tools like Snyk, Socket, and GitHub Dependabot report known vulnerabilities from esbuild@0.18.20 and 0.25.x, causing noise or outright CI failures
- **Enterprise and compliance environments block installs** — organizations with strict supply-chain policies cannot ship projects containing known-vulnerable native binaries
- **Downstream consumers are forced to apply workarounds** — `overrides` / `resolutions` / `pnpm.overrides` are fragile and shift the maintenance burden to every individual user
- **Vite 8 compatibility is broken** — the most widely used frontend build tool now explicitly requires `esbuild@^0.27.0`
- **Abandoned transitive dependencies are a supply chain risk** — `@esbuild-kit` will never be patched; it is dead code that ships vulnerable binaries

## Requested changes

1. **Bump esbuild** from `^0.25.x` to `^0.27.0`
2. **Replace `@esbuild-kit/esm-loader`** with `tsx` or another maintained alternative, eliminating `esbuild@0.18.20` entirely
3. **Add appropriate labels and prioritization to #5290** — a security issue open for months with no triage sends a concerning signal to the community

## Reproduction

```bash
mkdir repro && cd repro && pnpm init
pnpm add drizzle-kit drizzle-orm vite@8
pnpm why esbuild
# Output: 3 versions of esbuild (0.18.20, 0.25.x, 0.27.x)
```

## Environment

- `drizzle-kit`: 0.31.9
- `vite`: 8.0.0
- `esbuild` (resolved by drizzle-kit): 0.18.20, 0.25.12
- Package manager: pnpm 10.x
- Node.js: 22.x