Update @yao-pkg/pkg to 6.21.0 to resolve esbuild security alert

[wojtekn]

Related issues

• Related to Dependabot alert #232

How AI was used in this PR

Used Claude Code to trace the alert to its transitive source, bump the dependency, refresh the lockfile, and verify the vulnerable version was fully removed (dedupe check + npm audit + typecheck).

Proposed Changes

Dependabot alert #232 is a low-severity esbuild vulnerability (arbitrary file read via the dev server on Windows) affecting esbuild >= 0.27.3, < 0.28.1. esbuild was pulled in transitively by @yao-pkg/pkg, which pinned esbuild@^0.27.3.

This bumps @yao-pkg/pkg from 6.14.1 to 6.21.0. The newer release requires esbuild@^0.28.1, so the vulnerable range is gone and the tree resolves to esbuild 0.28.1. As a side effect the newer package dedupes a previously duplicated esbuild platform-binary tree, shrinking the lockfile.

No user-visible behavior change — @yao-pkg/pkg is a devDependency used only to compile the Windows CLI launcher into a standalone .exe during packaging (apps/studio/forge.config.ts). The exec API it relies on is unchanged.

Testing Instructions

• npm install resolves esbuild to 0.28.1 with no remaining 0.27.x copy.
• npm audit reports no esbuild vulnerability.
• npm run typecheck passes across all packages.
• Windows-only: @yao-pkg/pkg's exec API used in forge.config.ts is unchanged; the standalone CLI .exe packaging path (npm run make on Windows) is exercised only on Windows/CI and should be confirmed green there.

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[wpmobilebot]

📊 Performance Test Results

Comparing b0a6cdc vs trunk

app-size

Metric	trunk	b0a6cdc	Diff	Change
App Size (Mac)	1355.69 MB	1355.69 MB	+0.00 MB	⚪ 0.0%

site-editor

Metric	trunk	b0a6cdc	Diff	Change
load	1127 ms	1110 ms	17 ms	⚪ 0.0%

site-startup

Metric	trunk	b0a6cdc	Diff	Change
siteCreation	6498 ms	6499 ms	+1 ms	⚪ 0.0%
siteStartup	2388 ms	2394 ms	+6 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)