chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped browserslist to 4.28.9 via yarn resolution to resolve two high severity vulnerabilities (uncaught crash/prototype write, and unbounded memory growth)

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#77	browserslist	high	Bumped to 4.28.9 via yarn resolution
#76	browserslist	high	Bumped to 4.28.9 via yarn resolution

[Copilot]

🟡 Changes recommended

The browserslist resolution lower bound doesn’t match the PR’s stated target version for the security fix and should be tightened to avoid allowing older vulnerable patch versions.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR addresses two open Dependabot high-severity security alerts by forcing a patched browserslist version via Yarn resolutions, ensuring downstream tooling consumes the updated dependency.

Changes:

• Add a Yarn resolutions override for browserslist to enforce a non-vulnerable version range.
• Update yarn.lock to reflect browserslist@4.28.9 and its updated transitive dependency set (e.g., baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db).

File summaries

File	Description
package.json	Adds a resolutions entry to constrain browserslist versions.
yarn.lock	Locks browserslist to 4.28.9 and updates related transitive dependencies accordingly.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.