chore(deps): bump browserslist from 4.25.4 to 4.28.9

[dependabot]

Bumps browserslist from 4.25.4 to 4.28.9.

Release notes

Sourced from browserslist's releases.

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

4.28.1

• Removed Baseline warning since we have it own warning.

4.27.0

• Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

• Fixed throwOnMissing with extends query (by @​alexander-akait).

4.26.2

• Fixed baseline-browser-mapping version requirement.

4.26.1

• Updated Firefox ESR.

4.26.0

• Added Baseline queries (by @​tonypconway).

Changelog

Sourced from browserslist's changelog.

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

4.28.1

• Removed Baseline warning since we have it own warning.

4.48.0

• Added firefox >= esr query support (by @​SethFalco).
• Fixed docs (by @​SethFalco).

4.27.0

• Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

• Fixed throwOnMissing with extends query (by @​alexander-akait).

... (truncated)

Commits

• 12ed525 Release 4.28.9 version
• b1d8cf9 Update dependencies
• 21517b6 Improve or parsing performance
• f2f2e6c Release 4.28.8 version
• d0787c8 Update dependencies
• fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
• 57ecd64 fix: support "including kaios" without downstream
• 093a0f6 Update EM banner
• b637868 Release 4.28.7 version
• 313f465 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[joshuanapoli]

Summary

Bumps browserslist 4.25.4 -> 4.28.9, resolving GHSA-73wf-gq98-2v4g (high: uncaught crash / prototype write in normalizeStats() when parsing an untrusted browserslist-stats.json). Pulls the accompanying data-package updates (caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db 1.3.2) and the new baseline-browser-mapping dependency. Lockfile/PnP-cache only; no source or manifest changes.

Risks

Low.

• Not exploitable here. The advisory requires browserslist to load a custom browserslist-stats.json. This repo has no browserslist field in package.json, no .browserslistrc, and no stats file, so normalizeStats() is never reached with attacker-controlled input. The bump is hygiene against a dev-scope alert rather than a live exposure.
• Dev-scope and effectively inert. browserslist is transitive via @babel/helper-compilation-targets@7.29.7 -> Babel. Our runtime dependencies are only axios and commander, so nothing reaches the shipped CLI. On top of that, jest.config.js transforms through @swc/jest with an explicit target: "es2020", not babel-jest — so the Babel target-resolution path that would consume browserslist is not in our transform pipeline at all.
• Minor-version bump within 4.x; the browserslist() API is unchanged. The bulk of the diff is refreshed browser-compat data, which only matters to consumers that resolve queries — we have none.
• New transitive package baseline-browser-mapping@2.11.21 enters the dev tree. It is a data package (browser baseline tables) required by browserslist 4.28.x, added to the Yarn PnP cache in this diff.

Analysis

• Read the advisory (GHSA-73wf-gq98-2v4g, vulnerable <= 4.28.6, first patched 4.28.7); 4.28.9 clears it.
• Diffed yarn.lock against main: changes are confined to browserslist and its own dependency set, with no unrelated resolution drift and no change to brace-expansion or other unrelated entries.
• Traced reverse dependencies in the lockfile and checked jest.config.js and package.json to confirm dev-only, transitive, and unexercised usage.
• Grepped the repo for browserslist configuration to confirm the vulnerable code path is unreachable.
• Rebased the branch onto current main first, so CI validated this lockfile on top of the already-merged #32 and #33 rather than a stale base. CI (test job, workflow CI) then passed: it runs yarn install --immutable --immutable-cache — which verifies the lockfile and the PnP zip cache in this diff — followed by prettier --check, eslint ., jest, and tsc.

No mitigating changes were needed.