chore(deps): patch and deduplicate browserslist

[martinothamar-agent]

Description

Updates and deduplicates Browserslist 4.24.5, 4.25.2 and 4.28.1 to 4.28.7 to remove the dependency affected by CVE-2026-73089 (unbounded cache growth). Current build queries are repository-controlled, so no exploitable application path was found; this is preventive dependency maintenance.

Updated the Yarn lockfile resolution, ran targeted Browserslist deduplication, and refreshed its required browser-data dependencies. All existing parent ranges accept 4.28.7; no manifest overrides or application changes were needed.

Risk assessment

Low risk. The update stays within all existing dependency ranges and affects build tooling. Refreshed browser data can change the targets selected by queries such as >0.2%, potentially changing Babel transforms or polyfills. The production Webpack build explicitly targets es2020, which limits this impact. Builds, type checks, lint, and 295 targeted tests passed; deployed behavior in older browsers was not manually tested.

Related Issue(s)

• Dependabot alert #358

Verification/QA

• Passed immutable install, deduplication check, yarn tsc, yarn lint, and yarn build.
• Passed 295 tests across five schema/validation suites; both configured Browserslist environments resolve successfully.
• No new tests needed: dependency maintenance covered by existing tests.
• No DOM, documentation, or Altinn Studio changes needed.
• Maintainer: add kind/dependencies and backport-ignore (the PR author lacks label permissions).

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 685c67a7-6b6d-4b25-a2fc-cca69178e732

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[martinothamar]

2 failed runs, different tests flaking, so every test has been green once 😅