chore: upgrade browserslist to ^4.28.8 to address CVE-2026-73088, CVE-2026-73089 - #1624
Open
claude[bot] wants to merge 2 commits into
Open
chore: upgrade browserslist to ^4.28.8 to address CVE-2026-73088, CVE-2026-73089#1624claude[bot] wants to merge 2 commits into
claude[bot] wants to merge 2 commits into
Conversation
…-2026-73089 Refreshes the stale yarn.lock entry for browserslist. The existing ^4.24.0 range already admitted the patched 4.28.7+ releases. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
Contributor
License Audit
Weak Copyleft Packages (informational)
Resolved Packages (26)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes SOU-2115
Fixes SOU-2116
Summary
Refreshes the stale
yarn.lockentry forbrowserslistfrom4.24.4to4.28.8, which is at or above the4.28.7patched floor for both advisories.browserslistis a transitive dependency reached via@babel/helper-compilation-targets, requested asbrowserslist@npm:^4.24.0. That range already admitted the patched release, so this is a lockfile refresh only (yarn up -R browserslist). Nopackage.jsonchange and noresolutionsoverride were required.Advisories addressed
browserslist-stats.jsoncustom stats (normalizeStats). Patched in4.28.7.4.28.7.Verification
yarn why browserslistreports a single instance,browserslist@npm:4.28.8— no vulnerable version remains in the dependency graph.yarn install --immutablesucceeds.yarn testpasses: 2153 tests acrossqueryLanguage,shared,backend, andweb.yarn buildsucceeds for all workspaces, including the Next.js production build (browserslist is consumed at build time by Babel/PostCSS).🤖 Generated with Claude Code
Note
Low Risk
Dependency lockfile bump with no application code changes; risk is limited to build-time browser-target resolution behavior from the updated Browserslist stack.
Overview
Lockfile-only refresh that pins transitive
browserslistfrom 4.24.4 to 4.28.8 (at/above the 4.28.7 fix floor). Nopackage.jsonor resolutions changes—the existing^4.24.0range from Babel already allowed this version.The lock update also pulls in newer
browserslistcompanion data:baseline-browser-mapping@2.11.20,caniuse-lite@1.0.30001810,electron-to-chromium@1.5.420,node-releases@2.0.54, andupdate-browserslist-db@1.3.2.Addresses CVE-2026-73088 (crash/prototype issues via untrusted custom stats) and CVE-2026-73089 (unbounded memory growth on distinct queries).
Reviewed by Cursor Bugbot for commit 82fb585. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by cubic
Upgrades
browserslistfrom4.24.4to4.28.8inyarn.lockto fix CVE-2026-73088 and CVE-2026-73089. Fixes SOU-2115 and SOU-2116.^4.24.0range already admitted the patched release, so this is a lockfile-only refresh with nopackage.jsonorresolutionschanges.4.28.7;4.28.8is at or above that floor.yarn install --immutable, the full test suite (2153 tests), and all workspace builds including the Next.js production build.Written for commit 82fb585. Summary will update on new commits.