fix: pin esbuild across the whole tree, so npm 10 installs the lockfile too

`overrides.tsup.esbuild` pinned esbuild for tsup alone, and npm 10 and npm 11
then built different trees from the same manifest:

- npm 11 collapsed the tree onto esbuild 0.19.7.
- npm 10 kept vite's own esbuild 0.28.2 beside it, so the lockfile that npm 11
  wrote looked incomplete and `npm ci` stopped with
  "Missing: esbuild@0.28.2 from lock file", for esbuild and its 25
  per-platform packages.

One lockfile could not serve both resolvers, so the test workflow installed
npm 11 on each leg. A contributor on node 20 or node 22 still met the failure
locally, because those versions ship npm 10.

`overrides.esbuild` pins the whole tree instead, and one lockfile then serves
both. The workflow no longer installs npm 11, and the stock npm of each node
version installs this lockfile:

| node | npm | `npm ci` |
| --- | --- | --- |
| 20 | 10.8.2 | passes |
| 22 | 10.9.8 | passes |
| 24 | 11.19.0 | passes |

The bundle does not change: release/cjs/lossless.cjs and
release/cjs/lossless.cjs.map stay byte-identical to the files that
cornerstonejs/codecs vendors, and the lint and all 54 tests pass on each node
version and on windows.

`npm audit` moves from 1 moderate to 4 moderate, and stays at 0 high and 0
critical. All four are the one esbuild development-server advisory, which now
reaches more paths because the pin covers the whole tree. This repository never
starts that server.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: wayfarer3130

.github/workflows/test.yml

@@ -17,17 +17,10 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
-      # npm 11 on every leg. npm 10 and npm 11 do not resolve the nested
-      # `overrides.tsup.esbuild` in package.json the same way: npm 11 settles
-      # the whole tree on esbuild 0.19.7, while npm 10 keeps vite's own
-      # esbuild 0.28.2 and then reports the lockfile as out of sync
-      # ("Missing: esbuild@0.28.2 from lock file"). One lockfile cannot serve
-      # both, so this repository needs npm 11 everywhere. Node 20 ships npm
-      # 10.8 and node 22 ships npm 10.9; node 24 already bundles npm 11.19,
-      # which is why release.yml pins node 24.20.0.
-      - run: npm install --global npm@^11
       # `npm ci` rather than `npm install`: the lockfile is the tested input,
-      # and release.yml installs the same way.
+      # and release.yml installs the same way. The stock npm of each node
+      # version is enough — npm 10.8 (node 20), npm 10.9 (node 22) and
+      # npm 11.19 (node 24) all install this lockfile.
       - run: npm ci
       - run: npm run build
       - name: Lint

README.md

@@ -57,10 +57,16 @@ the 2.1.2 build, and it did not hold the fix that the same commit added to
 Two versions in `package.json` are held on purpose, and each one keeps the
 build stable:
 
-- `overrides.tsup.esbuild` holds esbuild at `0.19.7`. esbuild emits the bundle,
-  and a different esbuild emits different JavaScript for the same source. The
-  pin lets `npm audit fix` update the test tools without a change to the
-  published artifact. `cornerstonejs/codecs` pins esbuild for the same reason.
+- `overrides.esbuild` holds esbuild at `0.19.7`. esbuild emits the bundle, and
+  a different esbuild emits different JavaScript for the same source. The pin
+  lets `npm audit fix` update the test tools without a change to the published
+  artifact. `cornerstonejs/codecs` pins esbuild for the same reason.
+
+  The pin covers the whole tree on purpose. A pin of `tsup` alone, as
+  `overrides.tsup.esbuild`, makes npm 10 and npm 11 build different trees —
+  npm 11 collapses the tree onto 0.19.7 and npm 10 keeps vite's esbuild
+  0.28.2 beside it — and then one lockfile cannot serve both. With this flat
+  pin, npm 10.8, npm 10.9 and npm 11.19 all install the same lockfile.
 - `typescript` uses `~5.4.3`, not `^5.4.3`. TypeScript 5.7 made
   `ArrayBufferLike` stop satisfying `ArrayBuffer`, and `src/decoder.ts` line 93
   then fails to compile, which fails the declaration build. Raise the pin