DSO-26217: patch Browserslist vulnerability

[robertvangor]

Update the transitive Browserslist dependency from 4.28.1 to 4.28.9 through a version-scoped npm override and regenerate package-lock.json. This fixes DSO-26217, CVE-2026-73088, and the adjacent CVE-2026-73089 cache issue.

Browserslist is used by the Babel build and test tooling. Runtime SDK dependencies are unchanged. The update stays on Browserslist 4.x and includes the parsing corrections in 4.28.9.

Advisories: custom stats validation, unbounded cache growth.

Validation

On Node 24.19.0:

• npm ci --ignore-scripts --no-audit --no-fund passed.
• npm test -- --runInBand passed, including the Babel build and 158 tests in 6 suites.
• npm run lint passed.
• npm audit --json no longer reports Browserslist. Existing findings remain for @humanfs/node, brace-expansion, js-yaml, and minimatch, outside this ticket.
• git diff --check passed.

[review-swarm]

Staffbase AI Code Review

Verdict: ✅ Approved

Diff classified as trivial (≤10 lines, ≤5 files). No reviewers run.

📌 Only the first push is reviewed automatically. After that, comment @swarm review to re-review the latest commit.

• Risk tier: trivial
• Size: XS (trivial to review)
• Head commit: 06fc1fb
• Findings: 0 critical, 0 warning, 0 suggestions

Findings

No findings.

---

Bot commands

• @swarm ignore <id> [<id>...] — dismiss one or more findings by id (space-separated, including criticals — review each one before dismissing).
• @swarm ignore-all — dismiss every open warning/suggestion (criticals must be dismissed explicitly via ignore <id>).
• @swarm reset-ignores — clear all dismissals on this PR.
• @swarm review — re-run the review against the latest commit.

You can also resolve a non-critical inline conversation to ignore it (and unresolve to bring it back). Resolving a critical conversation is not supported — use ignore <id> instead.

To bypass the entire review (criticals included), apply the break-glass label to the PR.

Execution Steps (3)

1. Filter Diff — ✅ completed
   • Files: 1, +2/-1 lines
2. Reviewer Pipeline — ⏭️ skipped
   • Reason: trivial tier
3. Judge Pass — ⏭️ skipped
   • Reason: trivial tier