Bump browserslist from 4.28.6 to 4.28.8

[dependabot]

Bumps browserslist from 4.28.6 to 4.28.8.

Release notes

Sourced from browserslist's releases.

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

Changelog

Sourced from browserslist's changelog.

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

Commits

• f2f2e6c Release 4.28.8 version
• d0787c8 Update dependencies
• fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
• 57ecd64 fix: support "including kaios" without downstream
• 093a0f6 Update EM banner
• b637868 Release 4.28.7 version
• 313f465 Update dependencies
• c935c5a Fix regexp performance
• d7e9e65 Rewrite structure parsing to make it always fast
• ec4a55e Fix import order
• Additional commits viewable in compare view

[bgentry]

@dependabot rebase

[bgentry]

🤖 Codex review: Approved after dependency security and compatibility review.

Upgrade

• browserslist: 4.28.6 → 4.28.8
• Transitive refresh: baseline-browser-mapping 2.10.43 → 2.11.20, caniuse-lite 1.0.30001806 → 1.0.30001810, electron-to-chromium 1.5.393 → 1.5.420, node-releases 2.0.51 → 2.0.54, and update-browserslist-db 1.2.3 → 1.3.2
• Reviewed head: 930b56f369e1908b2877cd9de8da3ce3eaf900c9

Security review

• Confirmed security update. It fixes browserslist CVE-2026-73088/GHSA-73wf-gq98-2v4g (prototype write and build-process crash) and CVE-2026-73089/GHSA-c83g-rgw3-j3cx (unbounded cache growth/OOM), plus transitive baseline-browser-mapping CVE-2026-45819/GHSA-w5vr-8v7q-w6rv (process-termination DoS).
• Inspected the exact old/new registry artifacts and source changes. Lockfile SHA-512 values match the canonical npm tarballs. Every new artifact has an npm registry signature and GitHub Actions SLSA provenance; publishers, maintainers, repositories, licenses, and registry origins remain expected.
• The lockfile changes six existing entries only: no packages added or removed, lifecycle-hook or bin changes, native/WASM payloads, non-registry sources, weak integrity values, or same-version integrity rewrites.
• The fixes are present in the artifacts: bounded caches, prototype-safe stats normalization, linear query parsing/RegExp hardening, and removal of the Baseline library's process.exit() path. No credential access, telemetry, obfuscation, or hidden install execution was found.

Compatibility verification

• The rebased head has exactly the same Git tree as the independently constructed master + reviewed dependency delta used for local validation.
• npm ci --ignore-scripts — passed.
• npm run lint — passed.
• npm run test:once — 34 files / 233 tests passed.
• npm run build — passed; the complete emitted dist tree is byte-identical to current master, so the browser-data refresh does not change River UI's production assets.
• npm audit improves from two high-severity vulnerable packages on master to one unrelated pre-existing brace-expansion advisory.

Residual risk

• The browser datasets are generated and broadly refreshed; provenance is strong, but consumers using unusual Baseline/KaiOS queries can legitimately see target changes. River UI's emitted assets are unchanged.
• node-releases provenance attests the workflow's pre-sync commit rather than the post-sync npm gitHead; inspected package/data files match the post-sync source exactly.
• The private riverproui image workflow is expected to fail AWS OIDC before any build step; this is the known release-workflow gap rather than dependency incompatibility.