From 3a9374001d5f3fbe23bec84914adbd822b3a0818 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Tue, 1 Sep 2026 18:14:20 -0400 Subject: [PATCH] fix(deps): override browserslist to 4.28.7+ for GHSA-c83g-rgw3-j3cx Two newly published HIGH advisories against browserslist <= 4.28.6 (unbounded memory growth from an unevicted query-result cache, plus a crash/prototype-write via untrusted browserslist-stats.json), patched in 4.28.7. Reached transitively via babel (Expo toolchain), so no direct dependency to bump. Overridden at the workspace root. pnpm-lock.yaml is gitignored in this repo -- dependency-audit.yml generates a synthetic pnpm-workspace.yaml (stubs/@nself/*) and runs a fresh pnpm install --no-frozen-lockfile on every run, so there is no committed lockfile to regenerate here; the package.json override is the whole fix. Verified locally by reproducing that workflow's stub-workspace setup and running the same install: browserslist resolves to 4.28.8, and pnpm audit --audit-level=high exits 0 (2 high findings, both pre-existing ignored CVEs unrelated to this change). --- package.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index 1e9b5a1..2f3a60c 100644 --- a/package.json +++ b/package.json @@ -76,7 +76,8 @@ "js-yaml@3": "3.15.1", "js-yaml@4": "4.3.1", "undici@7": "7.29.0", - "nanoid@3": "3.3.18" + "nanoid@3": "3.3.18", + "browserslist@<4.28.7": "^4.28.7" }, "auditConfig": { "ignoreCves": [