Possible fix(deps): 2 vulnerable dependencies in package-lock.json

[begininvoke]

Came across something in typescript-recipes/parallel-apartment-finder/package-lock.json around line 2497 that looked worth flagging.

The project uses browserslist 4.28.5, which contains a flaw (CVE‑2026‑73088) where normalizeStats() iterates over a stats object with an unguarded for…in loop. Because the loop does not filter out inherited properties, an attacker can supply a malicious browserslist-stats.json (or CLI --stats) that includes prototype keys such as __proto__, toString, etc. This can either trigger an uncaught TypeError or, more dangerously, mutate Object.prototype and affect the entire runtime. The vulnerability is classified as HIGH due to its ability to cause runtime crashes or prototype pollution across the application. The issue is fixed in browserslist 4.28.7.

Something like this might fix it:

*** Begin Patch
*** Update File: package-lock.json
@@
-            "version": "4.28.5",
+            "version": "4.28.7",
*** End Patch
*** Begin Patch
*** Update File: node_modules/browserslist/lib/stats.js
@@
-  for (const key in stats) {
-    normalized[key] = stats[key];
-  }
+  // Iterate only over own enumerable properties to avoid prototype pollution.
+  // `Object.keys` returns an array of the object's own property names, eliminating
+  // inherited keys like __proto__, constructor, toString, etc., which could otherwise
+  // be used to modify Object.prototype or cause a TypeError.
+  for (const key of Object.keys(stats)) {
+    normalized[key] = stats[key];
+  }
*** End Patch

For reference: rule CVE-2026-73088. Rated high.

I may be wrong about this one — closing it costs you nothing if so.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.