Repository navigation
deps: bump browserslist in /demo to ≥4.28.7 #71
Description
What
demo/package-lock.json still resolves [email protected] (transitive). Root already has 4.28.8 via #66. CVE-2026-73089 / GHSA-c83g-rgw3-j3cx (High OOM) is fixed in 4.28.7+.
Where
demo/package-lock.json → node_modules/browserslist
Why
Build-time transitive High. Keep the demo lockfile on a patched browserslist.
Suggested fix
In /demo, bump/refresh so browserslist resolves to ≥4.28.7 (prefer 4.28.8), e.g. npm update browserslist or an overrides entry if needed. Confirm npm run build still works.
Activity