fix(deps): bump browserslist to 4.28.8 to resolve Dependabot alerts - #152
Merged
Conversation
Lockfile-only bump of the transitive browserslist dependency from 4.28.6 to 4.28.8 (all parents accept ^4.23.0 or wider): - GHSA-73wf-gq98-2v4g: uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) - GHSA-c83g-rgw3-j3cx: unbounded memory growth (no cache eviction) via distinct query results Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #151. Resolves the two new Dependabot alerts (#135, #136) by bumping the transitive browserslist dependency from 4.28.6 to 4.28.8 in
package-lock.json. Lockfile-only change (npm update browserslist); every parent (@babel/helper-compilation-targets,webpack,autoprefixer,core-js-compat, thecssnano/postcss-*family,@docusaurus/faster) declares^4.23.0or wider, so no override is needed.browserslist-stats.jsoncustom stats#136 GHSA-c83g-rgw3-j3cx (high): unbounded memory growth (no cache eviction) via distinct query results
Release notes review
No breaking changes:
including kaiosin baseline queries. We don't use baseline queries, so no effect on ourbrowserslistconfig.Both vulnerabilities only matter when browserslist is fed untrusted queries or a hostile
browserslist-stats.json; in this repo the queries come frompackage.jsonand there is no custom stats file, so exposure was already low.Still open: image-size (#127, #128)
Unchanged from #151: no patched release exists and Docusaurus is tracking the replacement in facebook/docusaurus#12231.
Verification
npm run build(Docusaurus production build) passesnpm run typecheckpassesnpm auditnow reports only the two image-size advisoriesLockfile diff touches
browserslistplus its own five data dependencies, whichnpm updaterefreshed to the versions its new range resolves to. All are browser-compatibility data packages with no code-behaviour impact on our build:🤖 Generated with Claude Code