[Aikido] Fix 3 security issues in baseline-browser-mapping, @ungap/structured-clone, feed

[aikido-autofix]

what

Upgrade baseline-browser-mapping, @ungap/structured-clone, and feed to fix DoS via process termination and RCE via unsafe deserialization.

why

✅ 3 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-626653	MEDIUM	[baseline-browser-mapping] The getCompatibleVersions() and getAllVersions() functions call process.exit() on invalid configuration options, allowing attackers to terminate the entire host process via user-controlled input. This denial-of-service vulnerability is fixed by throwing catchable errors instead.
AIKIDO-2026-11068	MEDIUM	[@ungap/structured-clone] The deserialize function unsafely instantiates constructors from attacker-controlled input, allowing remote code execution through dangerous constructors like Function or Worker. The vulnerability stems from missing validation of constructor names before instantiation.
AIKIDO-2025-10292	LOW	[feed] Affected versions of this package are vulnerable to improper input validation at multiple points in the code, such as when formatting the url in enclosures or processing XML feeds.

✅ Code not affected by breaking changes.

✅ No breaking changes affect this codebase. The methods getCompatibleVersions() and getAllVersions() from the baseline-browser-mapping package are not used anywhere in the codebase.

All breaking changes by upgrading baseline-browser-mapping from version 2.10.43 to 2.11.0 (CHANGELOG)

Version	Description
2.11.0	getCompatibleVersions() and getAllVersions() now throw an Error instead of calling process.exit() when unsupported option combinations are passed, requiring different error handling

references

[atmos-pro]

Tip

Atmos Pro  

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

[github-actions]

Warning

This PR is blocked from merging because a required semver label is missing.

major, minor, patch, no-release

You'll need to add one before this PR can be merged.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

• website/pnpm-lock.yaml

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.44%. Comparing base (8148b1d) to head (b68a04c).
⚠️ Report is 42 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2967   +/-   ##
=======================================
  Coverage   83.44%   83.44%           
=======================================
  Files        1923     1923           
  Lines      188072   188072           
=======================================
+ Hits       156928   156937    +9     
+ Misses      23227    23217   -10     
- Partials     7917     7918    +1     

Flag	Coverage Δ
unittests	83.44% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 8 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mergify]

💥 This pull request now has conflicts. Could you fix it @aikido-autofix[bot]? 🙏