chore(deps): remediate PROD-5195 transitive npm vulnerabilities

[plural-copilot]

Security summary

Remediates PROD-5195 by adding root-level npm overrides for the three reported vulnerable transitive packages:

• browserslist → 4.28.7
• decode-uri-component → 0.5.0
• @humanfs/node → 0.16.8

The regenerated lockfile retains a single hoisted resolution for each target. No direct dependency declarations or GitOps files were changed.

Fixes PROD-5195

Plural Flow: marketing
Plural Preview: marketing

Validation

• npm ci — passed (exit 0; 811 packages added). Husky printed git command not found during prepare in the Node container but did not fail the command.
• npm ls browserslist decode-uri-component @humanfs/node --all — passed (exit 0), confirming the requested dependency paths and overridden versions.
• npm run lint — passed (exit 0).
• npm run build — passed (exit 0). It emitted a non-fatal Turbopack NFT tracing warning for next.config.ts and completed the production build.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Implement PROD-5195 in this repository and create a pull request from the branch exactly mjg/prod-5195-rolling-vulnerabilities-pluralshmarketing-non-critical....
🔗 Run history	View run history

[linear]

PROD-5195

[greptile-apps]

Greptile Summary

This PR adds root-level npm overrides and regenerates the lockfile to remediate three vulnerable transitive dependencies.

• Pins browserslist to 4.28.7, decode-uri-component to 0.5.0, and @humanfs/node to 0.16.8.
• Updates associated Browserslist data packages and @HumanFS dependencies.
• Retains a single locked resolution for each remediation target.

Confidence Score: 5/5

The dependency remediation appears safe to merge, with no actionable correctness, security, or repository-rule issues identified.

The manifest and lockfile consistently resolve all three targeted packages to the requested remediated versions, and no reachable incompatibility or reproducibility failure remains.

Important Files Changed

Filename	Overview
package.json	Adds three targeted transitive dependency overrides; no actionable compatibility or repository-rule issue was established.
package-lock.json	Regenerates the affected dependency resolutions consistently, with one intended version for each remediation target and no stale copies.

_{Reviews (1): Last reviewed commit: "chore(deps): remediate PROD-5195 npm vul..." | Re-trigger Greptile}

[plural-copilot]

✅ Deploy preview for marketing-pr-203 is ready!

Name	Details
⚡ Service	marketing-pr-203 (5 / 5 ready)
☁️ Cluster	plural (eks)
Commit sha	868c0ab
Plural URL	https://console.mgmt.plural.sh/cd/clusters/446acdef-8524-425a-a49f-5336a...
🔍 Logs URL	https://console.mgmt.plural.sh/cd/clusters/446acdef-8524-425a-a49f-5336a...
🌊 Flow URL	https://console.mgmt.plural.sh/flows/fbbadfa5-fa67-4c16-ab32-42dca133aa3...
Preview Link	Preview

---

You can learn more about preview environments and Plural Flows here