Skip to content

fix(deps): bump browserslist to 4.28.8 to resolve Dependabot alerts - #152

Merged
mpbarnwell merged 1 commit into
mainfrom
fix/dependabot-browserslist
Sep 3, 2026
Merged

fix(deps): bump browserslist to 4.28.8 to resolve Dependabot alerts#152
mpbarnwell merged 1 commit into
mainfrom
fix/dependabot-browserslist

Conversation

@mpbarnwell

@mpbarnwell mpbarnwell commented Sep 3, 2026

Copy link
Copy Markdown
Member

Summary

Follow-up to #151. Resolves the two new Dependabot alerts (#135, #136) by bumping the transitive browserslist dependency from 4.28.6 to 4.28.8 in package-lock.json. Lockfile-only change (npm update browserslist); every parent (@babel/helper-compilation-targets, webpack, autoprefixer, core-js-compat, the cssnano/postcss-* family, @docusaurus/faster) declares ^4.23.0 or wider, so no override is needed.

Package From To Alerts fixed
browserslist 4.28.6 4.28.8 #135 GHSA-73wf-gq98-2v4g (high): uncaught crash / prototype write via untrusted browserslist-stats.json custom stats
#136 GHSA-c83g-rgw3-j3cx (high): unbounded memory growth (no cache eviction) via distinct query results

Release notes review

No breaking changes:

  • 4.28.7 (changelog) — the security release: fixes the unbounded memory growth and the prototype write issue, plus a parsing performance improvement.
  • 4.28.8 — one bug fix for including kaios in baseline queries. We don't use baseline queries, so no effect on our browserslist config.

Both vulnerabilities only matter when browserslist is fed untrusted queries or a hostile browserslist-stats.json; in this repo the queries come from package.json and there is no custom stats file, so exposure was already low.

Still open: image-size (#127, #128)

Unchanged from #151: no patched release exists and Docusaurus is tracking the replacement in facebook/docusaurus#12231.

Verification

  • npm run build (Docusaurus production build) passes

  • npm run typecheck passes

  • npm audit now reports only the two image-size advisories

  • Lockfile diff touches browserslist plus its own five data dependencies, which npm update refreshed to the versions its new range resolves to. All are browser-compatibility data packages with no code-behaviour impact on our build:

    Package From To
    baseline-browser-mapping 2.10.43 2.11.20
    caniuse-lite 1.0.30001805 1.0.30001810
    electron-to-chromium 1.5.389 1.5.420
    node-releases 2.0.51 2.0.54
    update-browserslist-db 1.2.3 1.3.2

🤖 Generated with Claude Code

Lockfile-only bump of the transitive browserslist dependency from
4.28.6 to 4.28.8 (all parents accept ^4.23.0 or wider):

- GHSA-73wf-gq98-2v4g: uncaught crash / prototype write via untrusted
  browserslist-stats.json custom stats (normalizeStats)
- GHSA-c83g-rgw3-j3cx: unbounded memory growth (no cache eviction) via
  distinct query results

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@mpbarnwell
mpbarnwell merged commit 74df90e into main Sep 3, 2026
5 checks passed
@mpbarnwell
mpbarnwell deleted the fix/dependabot-browserslist branch September 3, 2026 09:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant