chore(deps): absorb the browserslist September advisories in word-addin
From the PR description
Summary
The dependency-audit gate goes red on every branch - main included - at its next run: GHSA-c83g-rgw3-j3cx and GHSA-73wf-gq98-2v4g landed today against browserslist <= 4.28.6, and word-addin/package-lock.json held 4.28.4.
What changed
One transitive dev-dependency bump: browserslist 4.28.4 → 4.28.8 (with its caniuse-lite companion), word-addin lockfile only.
Why it changed
Both advisories are high-severity (unbounded cache growth → OOM, and a prototype write via untrusted browserslist-stats.json). The audit gate treats un-allowlisted highs as failures by design.
Base case
On main: cd word-addin && npm ci && npx better-npm-audit audit (or re-run the security workflow) → fails listing the two GHSA ids above. On this branch: the same audit passes; npm run typecheck --prefix word-addin and npm run build --prefix word-addin unaffected (dev-only transitive).
Notes
The org stack (#267) carries the same commit so its CI stays green; whichever lands second dedupes at rebase - the same pattern as the history/page clock pin (#390).
🤖 Generated with Claude Code
Capture this PR into my fork
Download a Markdown prompt that tells Claude how to port every
commit in this PR into your working tree. Run it via
claude -p < capture-pull-422.md from
inside the repo you want the changes in.