chore: upgrade browserslist to ^4.28.8 to address CVE-2026-73088, CVE-2026-73089

[claude]

Fixes SOU-2115
Fixes SOU-2116

Summary

Refreshes the stale yarn.lock entry for browserslist from 4.24.4 to 4.28.8, which is at or above the 4.28.7 patched floor for both advisories.

browserslist is a transitive dependency reached via @babel/helper-compilation-targets, requested as browserslist@npm:^4.24.0. That range already admitted the patched release, so this is a lockfile refresh only (yarn up -R browserslist). No package.json change and no resolutions override were required.

Advisories addressed

• CVE-2026-73088 — Browserslist: uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats). Patched in 4.28.7.
• CVE-2026-73089 — Browserslist: unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM. Patched in 4.28.7.

Verification

• yarn why browserslist reports a single instance, browserslist@npm:4.28.8 — no vulnerable version remains in the dependency graph.
• yarn install --immutable succeeds.
• yarn test passes: 2153 tests across queryLanguage, shared, backend, and web.
• yarn build succeeds for all workspaces, including the Next.js production build (browserslist is consumed at build time by Babel/PostCSS).

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only transitive dependency bump with no application code changes; typical low-risk security maintenance for build-time tooling.

Overview
Security dependency refresh for the transitive browserslist package (used at build time via Babel/PostCSS), bumping the resolved version in yarn.lock from 4.24.4 to 4.28.8 to address CVE-2026-73088 and CVE-2026-73089 (patched in 4.28.7+). No package.json or resolutions changes—the existing ^4.24.0 range already allowed this release.

The lockfile update also pulls newer transitive browser-data packages (caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db, and baseline-browser-mapping). CHANGELOG records the upgrade under [Unreleased] → Fixed.

^{Reviewed by Cursor Bugbot for commit 262a3d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Upgrades browserslist from 4.24.4 to 4.28.8 in yarn.lock to fix CVE-2026-73088 and CVE-2026-73089. Fixes SOU-2115 and SOU-2116.

• The existing ^4.24.0 range already admitted the patched release, so this is a lockfile-only refresh with no package.json or resolutions changes.
• Both advisories are patched in 4.28.7; 4.28.8 is at or above that floor.
• Verified with yarn install --immutable, the full test suite (2153 tests), and all workspace builds including the Next.js production build.
• Adds a Fixed entry to CHANGELOG.md and dedupes caniuse-lite to 1.0.30001810.

^{Written for commit 262a3d5. Summary will update on new commits.}

[github-actions]

License Audit

⚠️Status: PASS

Metric	Count
Total packages	2174
Resolved (non-standard)	8
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.13	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (8)

Package	Version	Original	Resolved	Source
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	GitHub repo (github.com/livebook-dev/codemirror-lang-elixir LICENSE, SPDX-detected Apache-2.0); vendored node_modules LICENSE is verbatim Apache-2.0
khroma	2.1.0	UNKNOWN	MIT	GitHub repo (github.com/fabiospampinato/khroma LICENSE, SPDX-detected MIT); vendored node_modules license is verbatim MIT
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	GitHub repo (github.com/livebook-dev/lezer-elixir LICENSE, SPDX-detected Apache-2.0); vendored node_modules LICENSE is verbatim Apache-2.0
map-stream	0.1.0	UNKNOWN	MIT	GitHub repo (github.com/dominictarr/map-stream LICENCE, SPDX-detected MIT); vendored node_modules LICENCE is verbatim MIT
memorystream	0.3.1	UNKNOWN	MIT	extracted from object: npm registry legacy 'licenses' field [{type:'MIT',...}]; corroborated by GitHub repo SPDX-detected MIT and vendored LICENSE
pause-stream	0.0.11	["MIT","Apache2"]	MIT OR Apache-2.0	extracted from object: license array ['MIT','Apache2']; vendored LICENSE states 'Dual Licensed MIT and Apache 2' and contains both full texts ('Apache2' normalized to SPDX 'Apache-2.0')
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	resolved 'SEE LICENSE IN LICENSE' by reading the referenced file: node_modules/posthog-js/LICENSE is Apache-2.0 (a trailing MIT notice applies only to specific vendored Sentry files)
valid-url	1.0.9	UNKNOWN	MIT	vendored node_modules/valid-url/LICENSE is the verbatim MIT license text (npm registry has no license field; GitHub returns NOASSERTION due to custom copyright header)