Skip to content

fix: upgrade browserslist to address Dependabot alert 475 - #607

Merged
shanghaikid merged 1 commit into
mainfrom
fix/dependabot-475-browserslist
Sep 8, 2026
Merged

shanghaikid merged 1 commit into
mainfrom
fix/dependabot-475-browserslist

Conversation

@shanghaikid

Copy link
Copy Markdown
Contributor

Browserslist 4.24.2, pulled in by Jest/Babel, can crash on crafted custom statistics containing inherited property names (GHSA-73wf-gq98-2v4g). Add a browserslist: ^4.28.7 resolution and update the root lockfile to 4.28.9, including its required dependencies.

Addresses Dependabot alert #475.

Validation:

  • Reproduced the crash before upgrading; all six previously crash-inducing property names pass after upgrading.
  • npm run build passes.
  • NODE_ENV=dev npx jest test/utils/Validate.spec.ts --runInBand: 37 tests pass.
  • Frozen-lockfile installation, Prettier, and git diff --check pass.

Also reviewed alerts #473 and #462. Their affected APIs are not used by the current MinIO dependency: MinIO uses the JSONL parser rather than stream-json path filters, and query-string encoding rather than decoding. Direct overrides to the patched versions introduce API/module incompatibilities with the current MinIO dependency chain. Those alerts remain open and are not addressed by this PR.

Signed-off-by: ryjiang <jiangruiyi@gmail.com>
@sre-ci-robot

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: shanghaikid

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@codecov

codecov Bot commented Sep 8, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.82%. Comparing base (130cebd) to head (e579792).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #607   +/-   ##
=======================================
  Coverage   96.82%   96.82%           
=======================================
  Files          68       68           
  Lines        6924     6924           
  Branches     2016     2016           
=======================================
  Hits         6704     6704           
  Misses        212      212           
  Partials        8        8           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@shanghaikid
shanghaikid merged commit 6b7ae07 into main Sep 8, 2026
4 of 5 checks passed
@shanghaikid
shanghaikid deleted the fix/dependabot-475-browserslist branch September 8, 2026 03:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants