Vulnerable package: browserslist
2 high/high advisory entries reported by pnpm audit.
| Severity |
Title |
Vulnerable |
Patched |
Advisory |
| high |
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM |
<=4.28.6 |
>=4.28.7 |
1153171 |
| high |
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) |
<=4.28.6 |
>=4.28.7 |
1153172 |
Suggested action
Run pnpm update browserslist and verify with pnpm build. If the patched version is a major upgrade, check release notes for breaking changes first. Close this issue once the package is on a non-vulnerable version (the bot will re-open if new advisories appear).
Vulnerable package:
browserslist2 high/high advisory entries reported by
pnpm audit.<=4.28.6>=4.28.7<=4.28.6>=4.28.7Suggested action
Run
pnpm update browserslistand verify withpnpm build. If the patched version is a major upgrade, check release notes for breaking changes first. Close this issue once the package is on a non-vulnerable version (the bot will re-open if new advisories appear).