chore(security): upgrade Wrangler 3.x → 4.13.0 to fix esbuild vulnerability

[ashercoren]

Summary

• Upgrades wrangler from ^3.72.3 to 4.13.0 in vim--base-app-template--react
• Eliminates the vulnerable esbuild@0.17.19 that was pinned inside Wrangler 3.x (node_modules/wrangler/node_modules/esbuild)
• Wrangler 4.13.0 ships with esbuild 0.25.2, which is not affected

Security context

Wrangler 3.x pins esbuild@0.17.19, which is affected by GHSA-67mh-4wv8-2f99 — esbuild's dev server accepts cross-origin requests, allowing any website to read responses from the local dev server. The vulnerability is fully resolved in esbuild ≥0.25.3 (addressed in Wrangler ≥4.13.0).

Why 4.13.0 (pinned, not ^4.13.0)

Later 4.x releases (≥4.14.x) require Node ≥20.3.0. The project currently runs Node 18, so this is pinned to exactly 4.13.0 — the minimum version that resolves the vulnerability and is compatible with Node 18. When the project moves to Node 20+, the pin can be relaxed to ^4.x.x.

Breaking changes assessed

All Wrangler 4.0 breaking changes were reviewed against this repo's usage. None apply:

• Only wrangler pages dev is used (in the dev:functions script) — no removed commands are in use
• wrangler.toml only configures standard Pages bindings — no deprecated config fields present
• No getBindingsProxy, --node-compat, legacy assets, or removed D1 commands are used
• No dynamic wildcard imports in the functions/ source files

Test plan

• npm run dev starts successfully (both Vite and Wrangler Pages dev server)
• npm audit no longer reports the esbuild@0.17.19 vulnerability