The version of vite in Codex 2.0.0 (and generally below) requires an older version of esbuild; other libraries appear to do so as well.

This is a request for investigation of an update to a newer version of vite (and possibly other libraries, too) that gets esbuild up to a version addressing https://github.com/advisories/GHSA-67mh-4wv8-2f99 . That advisory's POC shows a browser console based make run-dev problem. Depending on the manner in which someone is using make run-dev this may be less or more of a problem. This does prove to work if using the browser console as shown in the POC. However, generally, CORS will block real webpage-executed requests (i.e., those not originating from someone copy-pasting intentionally, or at the prompting of a bad actor, code into a browser console). For example, the following stuffed into a real internet hosted webpage...

(function() {
    const aDiv = document.createElement('div');
    aDiv.textContent = 'Hi';
    aDiv.addEventListener('click', function() {
        fetch('https://127.0.0.1:1234/some_path', {headers: {"Accept": "application/json"}}).then(r => r.text()).then(content => console.log(content));
    });
    document.body.appendChild(aDiv);
})();

is likely to yield the following when clicking on the "Hi" <div>.

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://127.0.0.1:1234/some_path. (Reason: CORS request did not succeed). Status code: (null).

This blocking isn't necessarily reflective of merely making a request toward a 127.0.0.1 endpoint.

Nevertheless, there's a potential problem here. This is a request for folks more fluent in Codex to have a look at what might be viable here (be that within the Codex repo, upstream, or some combination).