Skip to content

[HIGH] Bump browserslist to 4.28.9 - #58336

Open
OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:codex/security-browserslist
Open

OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:codex/security-browserslist

Conversation

@OskarEichler

@OskarEichler OskarEichler commented Sep 4, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • update the existing Browserslist resolutions from 4.24.4 to 4.28.9
  • remediate GHSA-c83g-rgw3-j3cx (unbounded query-cache growth)
  • remediate GHSA-73wf-gq98-2v4g (uncaught crash/prototype write through custom stats)
  • keep the change limited to the lockfile and the already-compatible 4.x dependency range

Security impact

Browserslist 4.24.4 is affected by two high-severity advisories fixed in 4.28.7. This update uses 4.28.9, the latest 4.x release, without changing React Native package manifests.

Test Plan

  • yarn install --frozen-lockfile --ignore-scripts
  • yarn why browserslist (single 4.28.9 installation)
  • yarn audit no longer reports either Browserslist advisory
  • yarn build
  • yarn test packages/react-native-babel-preset --runInBand (5 suites, 117 tests, 16 snapshots)
  • git diff --check

Changelog:

[INTERNAL] [SECURITY] - Bump browserslist to 4.28.9.

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Sep 4, 2026
@facebook-github-tools facebook-github-tools Bot added the Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. label Sep 4, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant