fix(deps): patch browserslist custom statistics handling

[vivekanand1101]

Browserslist can crash on malicious custom statistics discovered by build tooling. Pin Browserslist to 4.28.7 and regenerate both npm and Yarn lockfiles.

• Addresses Dependabot #78; dismissed 5 non-applicable alerts with per-alert GitHub reasoning. Full review: docs/security/dependabot-2026-09-07.md.
• Adds executable security regressions for malicious custom statistics.
• Passed: npm install, Yarn install, npm run test:security-deps, and npm run build.
• npm run lint: passed.

Summary by CodeRabbit

• Security

  • Updated a browser compatibility component to address a security advisory.
  • Added safeguards to verify browser-target detection and protect against regressions involving sensitive property names.
  • Reviewed additional security advisories and documented their dispositions.

• Documentation

  • Added a security review record dated September 7, 2026, including upgrade actions, advisory dismissals, and reassessment conditions.

• Tests

  • Added a command to run security dependency verification checks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 5413b558-8a08-4d47-8b6b-680deb3fec8c

📥 Commits

Reviewing files that changed from the base of the PR and between 444ef86 and 32e5193.

⛔ Files ignored due to path filters (2)

• package-lock.json is excluded by !**/package-lock.json
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (3)

• docs/security/dependabot-2026-09-07.md
• package.json
• scripts/verify-security-dependencies.mjs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change pins browserslist to version 4.28.7, adds a security verification command, and documents one upgrade and four advisory dismissals from the 7 September 2026 Dependabot review.

Changes

Security dependency review

Layer / File(s)	Summary
Browserslist pinning and command wiring package.json	Adds the test:security-deps script and pins browserslist to version 4.28.7 in resolutions and overrides.
Security regression verification scripts/verify-security-dependencies.mjs	Checks browserslist('defaults') with prototype-sensitive statistics keys. Logs failures and sets exit code 1.
Dependabot review record docs/security/dependabot-2026-09-07.md	Records the browserslist upgrade and usage-specific dismissals for fast-uri and @humanfs/node.
Estimated code review effort: 2 (Simple)	~10 minutes

Merge Risk: ⚪ Minimal · up to 32e51

This change pins Browserslist to the patched release and adds a regression command for malicious custom-statistics handling. The dependency resolution and verification coverage are consistent with the intended security fix, with no remaining merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 2 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: patching Browserslist custom statistics handling. This matches the dependency update and security regression coverage described in the pull request.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/dependabot-20260907

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}