[dependabot]

Bumps browserslist from 4.28.1 to 4.28.8.

Release notes

Sourced from browserslist's releases.

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

Changelog

Sourced from browserslist's changelog.

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

Commits

• f2f2e6c Release 4.28.8 version
• d0787c8 Update dependencies
• fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
• 57ecd64 fix: support "including kaios" without downstream
• 093a0f6 Update EM banner
• b637868 Release 4.28.7 version
• 313f465 Update dependencies
• c935c5a Fix regexp performance
• d7e9e65 Rewrite structure parsing to make it always fast
• ec4a55e Fix import order
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[nerveai]

Nerve PR review · ⏸ Hold (superseded by #469)

This is a patch bump of browserslist (4.28.1 → 4.28.8) and its five data and helper packages. It changes only the lockfile, and every package is dev-only. The only consumer is @babel/helper-compilation-targets, pulled in by @vitejs/plugin-react. web/ has no browserslist config, so the build output does not change. The bump closes GHSA-c83g-rgw3-j3cx and GHSA-73wf-gq98-2v4g (both high, browserslist ≤4.28.6) and GHSA-w5vr-8v7q-w6rv (baseline-browser-mapping <2.11.0). None of them is reachable here, because Nerve's build feeds browserslist no untrusted queries or stats files.

Completeness: all six entries resolve to registry.npmjs.org, and their integrity hashes match the registry. No engine floor goes above Node 22.12. The PR merges cleanly with main, and CI is green (run of 2026-09-01).

Hold reason: #469 names this PR in its list of PRs it replaces, and it moves the same six entries further (browserslist 4.29.2). A trial merge shows that landing this PR first makes #469 conflict in web/package-lock.json (the six entries, starting at line 6624). The cheaper path is to merge #469 and let Dependabot close this one. #432 rewrites the same baseline-browser-mapping entry, so the two conflict with each other as well. If #469 is dropped, this PR is safe to merge as-is.

_{Checked: lockfile diffed against the merge base and main at 6911364; hashes verified against the npm registry; GitHub advisory DB queried; trial merges against main and #469 (7ed1417). The frontend was not run locally (no sandboxed npm yet). There are no Python changes, so the backend sandbox was not run. · automated review by nerveai — mention @nerveai to ask a follow-up.}