chore(deps): bump esbuild to 0.28.1 and vitest to 4.1.x for security advisories (#4618)

Resolve transitive Dependabot alerts on the web lockfile.

esbuild >= 0.28.1 (GHSA-gv7w-rqvm-qjhr #239, GHSA-g7r4-m6w7-qqqr #238):
Deno-module RCE via NPM_CONFIG_REGISTRY and Windows dev-server arbitrary
file read. Forced via a pnpm-workspace override (esbuild is a regular dep
of vite, so the override applies cleanly); bounded to <0.29 to stay on the
verified line. vite 7.3.3 declares ^0.27.0, but the 0.28 JS API is
unchanged for vite's usage -- verified by the full test run and web build.

@vitest/browser >= 4.1.8 (GHSA-g8mr-85jm-7xhm #240): Browser Mode CDP
bridge bypasses allowWrite/allowExec, enabling config overwrite -> RCE.
Bumped the vitest devDep family (vitest, @vitest/browser-*, coverage-v8)
from ^4.0.18 to ^4.1.8; resolves to 4.1.9.

Verified: pnpm test (5685 passed), pnpm lint, pnpm build-web (exit 0).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/readest-app/package.json

@@ -232,9 +232,9 @@
     "@typescript/native-preview": "7.0.0-dev.20260312.1",
     "@vitejs/plugin-react": "^5.1.1",
     "@vitejs/plugin-rsc": "^0.5.23",
-    "@vitest/browser-playwright": "^4.0.18",
-    "@vitest/browser-webdriverio": "^4.0.18",
-    "@vitest/coverage-v8": "^4.0.18",
+    "@vitest/browser-playwright": "^4.1.8",
+    "@vitest/browser-webdriverio": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.8",
     "@wdio/cli": "^9.25.0",
     "@wdio/globals": "^9.23.0",
     "@wdio/local-runner": "^9.24.0",
@@ -263,7 +263,7 @@
     "vinext": "^0.0.21",
     "vite": "^7.3.3",
     "vite-tsconfig-paths": "^5.1.4",
-    "vitest": "^4.0.18",
+    "vitest": "^4.1.8",
     "wrangler": "^4.85.0"
   },
   "browserslist": [

pnpm-workspace.yaml

@@ -25,6 +25,7 @@ overrides:
   glob: '>=11.1.0'
   jws: '>=4.0.1'
   vite: '>=7.3.2 <8'
+  esbuild: '>=0.28.1 <0.29'
   srvx: '>=0.11.13'
   rollup: '>=4.59.0'
   undici: '>=7.24.0'