security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-73wf-gq98-2v4g	browserslist, jest	None	29.7.0	4.28.7		confirmed

Not Included

• Deferred by batch limit: 10 advisories. They will be considered by future runs.
• Other deferred scanner findings: 0.
• Unconfirmed attempted fixes: 0.

---

Note

Low Risk
Lockfile-only transitive dependency updates with no runtime or auth/data-path code changes; main effect is refreshed browser compatibility data used by tooling.

Overview
Security-focused lockfile refresh for the browserslist dependency tree (GHSA-73wf-gq98-2v4g). No application source or package.json changes—only yarn.lock.

Resolved versions move browserslist from 4.28.1 to 4.28.7, with matching bumps to its data/tooling deps: baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, and update-browserslist-db. These packages are typically pulled in transitively (e.g. via Jest/Babel tooling) and affect how supported browser targets are computed at build/test time.

^{Reviewed by Cursor Bugbot for commit fa37f0f. Bugbot is set up for automated code reviews on this repo. Configure here.}