Upgrade: [dependabot] - bump esbuild from 0.25.3 to 0.25.4 (#392)

[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [esbuild](https://github.com/evanw/esbuild) from 0.25.3 to 0.25.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.25.4</h2>
<ul>
<li>
<p>Add simple support for CORS to esbuild's development server (<a
href="https://redirect.github.com/evanw/esbuild/issues/4125">#4125</a>)</p>
<p>Starting with version 0.25.0, esbuild's development server is no
longer configured to serve cross-origin requests. This was a deliberate
change to prevent any website you visit from accessing your running
esbuild development server. However, this change prevented (by design)
certain use cases such as &quot;debugging in production&quot; by having
your production website load code from <code>localhost</code> where the
esbuild development server is running.</p>
<p>To enable this use case, esbuild is adding a feature to allow <a
href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS">Cross-Origin
Resource Sharing</a> (a.k.a. CORS) for <a
href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests">simple
requests</a>. Specifically, passing your origin to the new
<code>cors</code> option will now set the
<code>Access-Control-Allow-Origin</code> response header when the
request has a matching <code>Origin</code> header. Note that this
currently only works for requests that don't send a preflight
<code>OPTIONS</code> request, as esbuild's development server doesn't
currently support <code>OPTIONS</code> requests.</p>
<p>Some examples:</p>
<ul>
<li>
<p><strong>CLI:</strong></p>
<pre><code>esbuild --servedir=. --cors-origin=https://example.com
</code></pre>
</li>
<li>
<p><strong>JS:</strong></p>
<pre lang="js"><code>const ctx = await esbuild.context({})
await ctx.serve({
  servedir: '.',
  cors: {
    origin: 'https://example.com',
  },
})
</code></pre>
</li>
<li>
<p><strong>Go:</strong></p>
<pre lang="go"><code>ctx, _ := api.Context(api.BuildOptions{})
ctx.Serve(api.ServeOptions{
  Servedir: &quot;.&quot;,
  CORS: api.CORSOptions{
    Origin: []string{&quot;https://example.com&quot;},
  },
})
</code></pre>
</li>
</ul>
<p>The special origin <code>*</code> can be used to allow any origin to
access esbuild's development server. Note that this means any website
you visit will be able to read everything served by esbuild.</p>
</li>
<li>
<p>Pass through invalid URLs in source maps unmodified (<a
href="https://redirect.github.com/evanw/esbuild/issues/4169">#4169</a>)</p>
<p>This fixes a regression in version 0.25.0 where <code>sources</code>
in source maps that form invalid URLs were not being passed through to
the output. Version 0.25.0 changed the interpretation of
<code>sources</code> from file paths to URLs, which means that URL
parsing can now fail. Previously URLs that couldn't be parsed were
replaced with the empty string. With this release, invalid URLs in
<code>sources</code> should now be passed through unmodified.</p>
</li>
<li>
<p>Handle exports named <code>__proto__</code> in ES modules (<a
href="https://redirect.github.com/evanw/esbuild/issues/4162">#4162</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4163">#4163</a>)</p>
<p>In JavaScript, the special property name <code>__proto__</code> sets
the prototype when used inside an object literal. Previously esbuild's
ESM-to-CommonJS conversion didn't special-case the property name of
exports named <code>__proto__</code> so the exported getter accidentally
became the prototype of the object literal. It's unclear what this
affects, if anything, but it's better practice to avoid this by using a
computed property name in this case.</p>
<p>This fix was contributed by <a
href="https://github.com/magic-akari"><code>@​magic-akari</code></a>.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h2>0.25.4</h2>
<ul>
<li>
<p>Add simple support for CORS to esbuild's development server (<a
href="https://redirect.github.com/evanw/esbuild/issues/4125">#4125</a>)</p>
<p>Starting with version 0.25.0, esbuild's development server is no
longer configured to serve cross-origin requests. This was a deliberate
change to prevent any website you visit from accessing your running
esbuild development server. However, this change prevented (by design)
certain use cases such as &quot;debugging in production&quot; by having
your production website load code from <code>localhost</code> where the
esbuild development server is running.</p>
<p>To enable this use case, esbuild is adding a feature to allow <a
href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS">Cross-Origin
Resource Sharing</a> (a.k.a. CORS) for <a
href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests">simple
requests</a>. Specifically, passing your origin to the new
<code>cors</code> option will now set the
<code>Access-Control-Allow-Origin</code> response header when the
request has a matching <code>Origin</code> header. Note that this
currently only works for requests that don't send a preflight
<code>OPTIONS</code> request, as esbuild's development server doesn't
currently support <code>OPTIONS</code> requests.</p>
<p>Some examples:</p>
<ul>
<li>
<p><strong>CLI:</strong></p>
<pre><code>esbuild --servedir=. --cors-origin=https://example.com
</code></pre>
</li>
<li>
<p><strong>JS:</strong></p>
<pre lang="js"><code>const ctx = await esbuild.context({})
await ctx.serve({
  servedir: '.',
  cors: {
    origin: 'https://example.com',
  },
})
</code></pre>
</li>
<li>
<p><strong>Go:</strong></p>
<pre lang="go"><code>ctx, _ := api.Context(api.BuildOptions{})
ctx.Serve(api.ServeOptions{
  Servedir: &quot;.&quot;,
  CORS: api.CORSOptions{
    Origin: []string{&quot;https://example.com&quot;},
  },
})
</code></pre>
</li>
</ul>
<p>The special origin <code>*</code> can be used to allow any origin to
access esbuild's development server. Note that this means any website
you visit will be able to read everything served by esbuild.</p>
</li>
<li>
<p>Pass through invalid URLs in source maps unmodified (<a
href="https://redirect.github.com/evanw/esbuild/issues/4169">#4169</a>)</p>
<p>This fixes a regression in version 0.25.0 where <code>sources</code>
in source maps that form invalid URLs were not being passed through to
the output. Version 0.25.0 changed the interpretation of
<code>sources</code> from file paths to URLs, which means that URL
parsing can now fail. Previously URLs that couldn't be parsed were
replaced with the empty string. With this release, invalid URLs in
<code>sources</code> should now be passed through unmodified.</p>
</li>
<li>
<p>Handle exports named <code>__proto__</code> in ES modules (<a
href="https://redirect.github.com/evanw/esbuild/issues/4162">#4162</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4163">#4163</a>)</p>
<p>In JavaScript, the special property name <code>__proto__</code> sets
the prototype when used inside an object literal. Previously esbuild's
ESM-to-CommonJS conversion didn't special-case the property name of
exports named <code>__proto__</code> so the exported getter accidentally
became the prototype of the object literal. It's unclear what this
affects, if anything, but it's better practice to avoid this by using a
computed property name in this case.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/evanw/esbuild/commit/218d29e9da018d60cf87b8fb496bb8167936ff54"><code>218d29e</code></a>
publish 0.25.4 to npm</li>
<li><a
href="https://github.com/evanw/esbuild/commit/e66cd0bf6daebff56527540c433c69e49e9dcb13"><code>e66cd0b</code></a>
dev server: simple support for CORS requests (<a
href="https://redirect.github.com/evanw/esbuild/issues/4171">#4171</a>)</li>
<li><a
href="https://github.com/evanw/esbuild/commit/8bf33685941e857c2b0f10c4d719a895f9d1ceea"><code>8bf3368</code></a>
js api: validate some options as arrays of strings</li>
<li><a
href="https://github.com/evanw/esbuild/commit/1e7375a6be924f1b2b5e339268cd5a79b54d58f7"><code>1e7375a</code></a>
js api: simplify comma-separated array validation</li>
<li><a
href="https://github.com/evanw/esbuild/commit/5f5964d53815075839abf8c343af97051c429c55"><code>5f5964d</code></a>
release notes for <a
href="https://redirect.github.com/evanw/esbuild/issues/4163">#4163</a></li>
<li><a
href="https://github.com/evanw/esbuild/commit/adb5284c7490c41069651916b8496625f74eddef"><code>adb5284</code></a>
fix: handle <code>__proto__</code> as a computed property in exports and
add tests for s...</li>
<li><a
href="https://github.com/evanw/esbuild/commit/0aa9f7bf792e58a96a8342cb8ac4f3bcf79a5308"><code>0aa9f7b</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4169">#4169</a>:
keep invalid source map URLs unmodified</li>
<li><a
href="https://github.com/evanw/esbuild/commit/5959289d90667c5a4026e6fb32cc58bbed9fc88a"><code>5959289</code></a>
add additional guards for <a
href="https://redirect.github.com/evanw/esbuild/issues/4114">#4114</a>
when using <code>:is()</code></li>
<li>See full diff in <a
href="https://github.com/evanw/esbuild/compare/v0.25.3...v0.25.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=esbuild&package-manager=npm_and_yarn&previous-version=0.25.3&new-version=0.25.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]