Does esbuild still get bumped on minor version bumps?

[adamsuskin]

I saw @patak-dev mention in #19412:

We always update esbuild in each vite minor

It looks like the latest esbuild release is 0.27.1, but in the latest vite, esbuild is still pinned to 0.25.x:
https://github.com/vitejs/vite/blob/v7/packages/vite/package.json#L84

I'm asking because there is a CVE on esbuild's stdlib in vite 7.1 but 7.2 doesn't seem to address it either.