# chore: remove direct `esbuild` devDependency

esbuild is declared as a direct devDependency in the root package.json but is never imported directly anywhere in the codebase.

| | |
| --- | --- |
| Status | COPILOT-WRITTEN · CHECKS FAILING |
| Source | github:vitest-dev/vitest#10849 |
| Original | https://github.com/vitest-dev/vitest/pull/10849 |
| Workspace | Showcase |
| Tags | github, code, json, config |

## What it does

**Most of this change is one file: pnpm-lock.yaml holds 100% of the edited lines.**

Copilot opened this, so there is no author to ask. 2 files changed across 1 area of vitest-dev/vitest, 59 added and 341 removed.

esbuild is declared as a direct devDependency in the root package.json but is never imported directly anywhere in the codebase.

**Diagram: Where the change landed. Node size is not to scale; the line counts are exact.**

- vitest (2 files, 400 lines) [accent]
- Config (2 files, 400 lines) [bad]
- pnpm-lock.yaml (+59 −340) [bad]
- vitest -> Config
- Config -> pnpm-lock.yaml : heaviest

- **Written by an agent.** Copilot authored this change. The usual review shortcut, asking the person who wrote it, is not available, so everything a reviewer needs has to come from the diff itself.
- **Heaviest file.** pnpm-lock.yaml, +59 −340, which is 100% of the change.
- **No test changed.** 0 source files changed with no accompanying test edit.
- **Configuration touched.** pnpm-lock.yaml, package.json. Config changes are small in the diff and large in effect.
- **CI is red.** 1 check is failing, so the change is not currently in a mergeable state.

## File map

**Every file this change touches, heaviest first.**

Role is inferred from the path and risk from the path and the line count. Neither was read from the code.

| File | Role | Change | Risk |
| --- | --- | --- | --- |
| `pnpm-lock.yaml` | application code | modified, patch unavailable (generated or vendored file) | high |
| `package.json` | application code | modified, +0 −1 | low |

## Receipts

**Where each number above comes from.**

All of it is arithmetic over the file list and the check results, so it can be recomputed from the source.

- **Claim.** Copilot wrote this change.
  - Evidence: copilot-swe-agent
  - Where: commit 92a5ce7
- **Claim.** 2 files changed, +59 −341.
  - Evidence: package.json (+0 −1); pnpm-lock.yaml (+59 −340)
  - Where: https://github.com/vitest-dev/vitest/pull/10849
- **Claim.** pnpm-lock.yaml carries 100% of the changed lines.
  - Evidence: 399 of 400 changed lines
  - Where: pnpm-lock.yaml
- **Claim.** It arrived as 3 commits.
  - Evidence: Initial plan
  - Where: commit 92a5ce7
- **Claim.** CI reports 1 failing of 28.
  - Evidence: Test: e2e, node-24, windows-latest
  - Where: CI check: Test: e2e, node-24, windows-latest
- **Claim.** The change drew 3 comments.
  - Evidence: ### <span aria-hidden="true">✅</span> Deploy Preview for *vitest-dev* ready! | Name | Link | |:-:|------------------------| |<span aria-hidd…
  - Where: comment by netlify[bot]

## Where to attack

**What the shape of this diff suggests looking at first.**

These come from structure alone: which areas were touched, what was not touched alongside them, and what CI says. None of them is a judgement about the code.

- **Test: e2e, node-24, windows-latest is failing** (high)
  - No summary was published for this check.
  - Mitigation: Read the check output before anything else here matters.
- **Configuration changed** (high)
  - pnpm-lock.yaml, package.json changed. A config edit is usually a handful of lines and decides behaviour for an entire environment, so diff size is a poor guide to its blast radius.
  - Mitigation: Check what reads each of these values, and in which environments they differ.
- **1 file has no visible patch** (low)
  - pnpm-lock.yaml could not be retrieved, so nothing in this brief accounts for their contents.
  - Mitigation: Open these directly in the source.

## Merge order

**A reading order for the review, not a deployment plan.**

Ordered by how expensive each part is to get wrong, which is a structural property rather than an informed one.

1. **Read the failing check first.** Test: e2e, node-24, windows-latest is red. Everything else is provisional until that is understood.
2. **Review the configuration changes.** pnpm-lock.yaml, package.json. Smallest diff, widest effect.
3. **Then pnpm-lock.yaml.** The largest single file in the change, +59 −340.
4. **Decide whether a test is needed.** Nothing in this change adds or edits one.

## What this brief could not check

- No language model read this change. Every statement here is computed from file paths, line counts, and CI status, so it describes the shape of the diff and not what the diff means.
- 1 patch(es) were not retrieved, so any file among them is described by its stat line only.