SYN-674: Resolve remaining dependency vulnerabilities (superseded by #59)

[KARSE22]

Superseded by #59 after correcting the ticket and branch to SYN-674.

Follow-up to #31 for SYN-674. The remaining findings are in the example app's Create React App dependency tree and the root esbuild dependency. Both lockfile audits now report zero vulnerabilities.

Approach

Move the example to Vite because npm offers no compatible fixes for several remaining Create React App dependency chains. Keep the published library at 2.1.0, the React peer links, the existing API key environment variable, port 3000, and the build output folder. The six example source files are renamed to .jsx with identical contents, and lint includes the new extensions. The example now requires Node 20.19+ or 22.12+.

Use a scoped override to update tsup's esbuild dependency to 0.28.2 for the remaining low-severity advisory. The library build continues to use tsup, and the CI workflow is unchanged.

Validation

• Root and example lockfile audits report zero vulnerabilities, including development dependencies.
• Clean installs and both production builds pass locally. The library tests, lint, and build also pass in CI on Node 20, 22, and 24.
• Browser checks pass in development and production with mocked Lob responses: autocomplete selection, address autofill, manual edits, and test API key propagation. No browser page errors occurred.
• The library's CommonJS and ES module bundles and source maps are byte-identical across the esbuild update.

Security scan follow-up

GuardRails flags a medium-severity finding for ESLint 8.57.1, which is unchanged from main. Its recommended upgrade to 9.26.0 matches CVE-2025-50537, an advisory GitHub withdrew on February 3, 2026 because it concerns development-time rule testing. The advisory ID still needs confirmation in GuardRails before resolving the finding.

[guardrails]

⚠️ We detected 1 security issue in this pull request:

Vulnerable Libraries (1)

Severity	Details
Medium	pkg:npm/eslint@8.57.1 (t) upgrade to: 9.26.0

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.