test: cover nested esbuild lockfile entries

[mohanagy]

Summary

• Require every package-lock entry ending in node_modules/esbuild to resolve to 0.28.1.
• Add a regression case for a stale nested esbuild entry.

Root cause

The security contract only checked the root node_modules/esbuild lockfile entry, allowing a nested stale entry to escape the assertion.

Validation

• npm run test:package
• npm run typecheck

Fixes #143

Summary by CodeRabbit

• Tests
  • Expanded package integrity checks to verify all installed esbuild entries use the patched version 0.28.1.
  • Added coverage to detect and reject stale nested esbuild versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 98457278-91ac-49ba-a3b6-2451e4431ecf

📥 Commits

Reviewing files that changed from the base of the PR and between 66b8ecd and f5d912d.

📒 Files selected for processing (1)

• tests/package-contract.test.ts

---

📝 Walkthrough

Walkthrough

The package contract test now checks every root or nested esbuild lockfile entry for version 0.28.1, including a regression test for stale nested entries.

Changes

esbuild lockfile contract

Layer / File(s)	Summary
Validate all esbuild lock entries tests/package-contract.test.ts	Adds a helper that validates every node_modules/esbuild entry and tests rejection of stale nested versions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mohanagy/miftah#126: Updates the same package contract to enforce the patched esbuild version.

Poem

A bunny checks each lock with care,
Root and nested entries, everywhere.
“Zero point two-eight-one,” we sing,
No stale esbuild slips past the ring.
- Thump, test, and hop! 🐇

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers summary, root cause, and validation, but it omits the required Security impact section and checklist details.	Add a Security impact section and complete the required validation checklist, including relevant command results and any documentation notes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately describes the nested esbuild lockfile test coverage change.
Linked Issues check	✅ Passed	The PR matches #143 by adding a nested stale esbuild regression test and asserting all esbuild lock entries resolve to 0.28.1.
Out of Scope Changes check	✅ Passed	The change stays within the requested test-contract scope and does not introduce unrelated code or dependency changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/143-nested-esbuild-contract

---

_{Comment @coderabbitai help to get the list of available commands.}