fix(cli): reject known-bad esbuild versions at build time

[Srinivasan8888]

Problem

The CLI declares esbuild ^0.23.0, but a package manager overrides /
resolutions entry is honoured silently, so the CLI can bundle with a version
it has never been tested against.

esbuild 0.25.0 has an out-of-bounds source-index regression, fixed in 0.25.1,
that drops input sources entries while keeping the mapping indices. The
resulting chunks are internally inconsistent. Because the worker installs
source-map-support globally (entryPoints/managed-run-worker.js), the first
stack trace touching an affected chunk makes originalPositionFor throw
Error: No element indexed by N inside recordSpanException (otel/utils.ts).

The build itself reports success, so the failure only surfaces in a deployed run.

Change

Check esbuild.version — the version actually resolved, not the declared range —
at the top of bundleWorker:

• a known-bad version fails the build with a message naming the fixed release
  and pointing at the overrides entry that is the usual cause
• any other out-of-range version warns rather than fails, so users who
  deliberately move to a newer good release are not blocked

The known-bad list is a small table in esbuildVersion.ts, so future entries are
one line.

Cost/benefit

This adds a gate to every deploy and dev build, so the risk is a false
positive blocking a legitimate build. That is why only versions with a known
output-corrupting defect hard-fail; everything else warns. The benefit is that
the failure mode it replaces is a runtime crash inside a deployed task with a
message (No element indexed by 6) that gives no hint the cause is a
dependency pin.

Tests

packages/cli-v3/src/build/esbuildVersion.test.ts — 5 tests: in-range accepted,
0.25.0 rejected with the fix version named, 0.25.1 not rejected, out-of-range
warns without failing, unparseable version ignored.

pnpm vitest run src/build/esbuildVersion.test.ts   -> 5 passed
pnpm run typecheck                                 -> clean

Note: the cli-v3 suite has 5 failing test files and 1 failing test on unmodified
main (snapshot.test.ts and four "No test suite found" files). I baselined
before and after — this branch adds no new failures.

refs #4801

[changeset-bot]

🦋 Changeset detected

Latest commit: 6bb0237

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages

Name	Type
trigger.dev	Patch
@internal/dashboard-agent	Patch
@trigger.dev/build	Patch
@trigger.dev/core	Patch
@trigger.dev/python	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/rsc	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/sdk	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@trigger.dev/rbac	Patch
@trigger.dev/sso	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/metrics-pipeline	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/run-store	Patch
@internal/schedule-engine	Patch
@internal/tracing	Patch
@internal/webhook-engine	Patch
@internal/webhook-sources	Patch
@internal/testcontainers	Patch
@internal/cache	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Hi @Srinivasan8888, thanks for your interest in contributing!

This project requires that pull request authors are vouched, and you are not in the list of vouched users.

This PR will be closed automatically. See https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md for more details.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 13e6d6fd-6112-4fbc-a6a3-c744c2b8c099

📥 Commits

Reviewing files that changed from the base of the PR and between 1d55693 and 6bb0237.

📒 Files selected for processing (4)

• .changeset/esbuild-version-guard.md
• packages/cli-v3/src/build/bundle.ts
• packages/cli-v3/src/build/esbuildVersion.test.ts
• packages/cli-v3/src/build/esbuildVersion.ts

---

Walkthrough

The CLI now checks the resolved esbuild version before bundling. Known-bad versions produce an error and stop the build. Other versions outside the tested range produce a warning. The new checker defines the supported range and version issue type. Tests cover supported, known-bad, fixed, out-of-range, and unparsable versions. A Changeset documents the patch release.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}