fix(deps): resolve GHSA-73wf-gq98-2v4g in browserslist - #3909
Merged
Conversation
- Bumped browserslist 4.28.2 -> 4.28.8 (patched) via lockfile refresh; browserslist is a dev-only transitive dep (eslint-config-oclif -> eslint-plugin-unicorn -> core-js-compat), not shipped in the CLI runtime. - 4.28.8 raised its own dependency floors, so its required family deps were pulled forward: caniuse-lite, electron-to-chromium, node-releases, baseline-browser-mapping, update-browserslist-db. npm also incidentally deduped redundant nested @oclif/plugin-commands lockfile entries (version-preserving hoist). - No package.json change. - Closes Dependabot alerts: #396
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the transitive
browserslistdependency from the vulnerable4.28.2to the patched4.28.8, resolving GHSA-73wf-gq98-2v4g (high,A:HDoS via prototype-collision keys in an untrustedbrowserslist-stats.json).Scope: development only.
browserslistis reached solely through the ESLint tooling chain (eslint-config-oclif→eslint-plugin-unicorn→core-js-compat→browserslist);npm ls browserslist --omit=devis empty, so it is never invoked by the published CLI at runtime. Residual risk was limited to this repo's own dev/CI environment.This is a lockfile-only change (
git diff package.jsonis empty). Note the diff is broader than a single line, for two reasons — both expected:browserslist@4.28.8raised its own dependency floors (caniuse-lite ^1.0.30001809,node-releases ^2.0.53,electron-to-chromium ^1.5.402,update-browserslist-db ^1.3.0,baseline-browser-mapping ^2.11.12), all above the installed versions, so those five were pulled forward to satisfy 4.28.8's ranges. They are all part of the browserslist family and dev-only.@oclif/plugin-commands/node_modules/*copies to already-present top-level versions (version-preserving; npm only dedupes within satisfying ranges). This is npm's canonical output for the update — nopackage.jsonor resolved-version change for@oclif/plugin-commandsitself.Type of Change
Patch Updates (patch semver update)
Testing
Notes:
Dev-only transitive dependency bump; not part of the shipped runtime.
Steps:
npm ls browserslist --allshowsbrowserslist@4.28.8on every path (≥ 4.28.7, patched).git diff package.jsonis empty.npm run lint— 0 errors.npm test— 2340 passing, 0 failing.Related Issues
Dependabot alerts