What
demo/package-lock.json still resolves browserslist@4.28.2 (transitive). Root already has 4.28.8 via #66. CVE-2026-73089 / GHSA-c83g-rgw3-j3cx (High OOM) is fixed in 4.28.7+.
Where
demo/package-lock.json → node_modules/browserslist
Why
Build-time transitive High. Keep the demo lockfile on a patched browserslist.
Suggested fix
In /demo, bump/refresh so browserslist resolves to ≥4.28.7 (prefer 4.28.8), e.g. npm update browserslist or an overrides entry if needed. Confirm npm run build still works.
What
demo/package-lock.jsonstill resolvesbrowserslist@4.28.2(transitive). Root already has 4.28.8 via #66. CVE-2026-73089 / GHSA-c83g-rgw3-j3cx (High OOM) is fixed in 4.28.7+.Where
demo/package-lock.json→node_modules/browserslistWhy
Build-time transitive High. Keep the demo lockfile on a patched browserslist.
Suggested fix
In
/demo, bump/refresh so browserslist resolves to ≥4.28.7 (prefer 4.28.8), e.g.npm update browserslistor an overrides entry if needed. Confirmnpm run buildstill works.