build(deps-dev): bump browserslist and fast-uri past security advisories

[Gustavo-Cauzzi]

Resolves the open Dependabot alerts for fast-uri (#165, #166, #167, #168) and browserslist (#170), and, as a side effect of the browserslist bump, baseline-browser-mapping (#171).

Why this is a manual PR

None of these alerts has a Dependabot security update attempt recorded against it (no PR, no error), so nothing was going to land on its own. This is the lockfile change a Dependabot security update would have made. Both packages are transitive and the fixed versions sit inside their parents' existing semver ranges, so no package.json change or overrides entry is needed.

What this does

Lockfile-only refresh:

npx npm@11.19.1 update browserslist fast-uri --package-lock-only --before=2026-09-21

Package	Pulled in by	Before	After	Advisories cleared
fast-uri	ajv (webpack's schema-utils)	3.1.5	3.1.8	GHSA-5jgf-p345-68v8, GHSA-fph4-wmhf-6fwf, GHSA-f65p-4m7j-42xc, GHSA-jqff-g426-hqxp (fixed in 3.1.6)
browserslist	webpack	4.28.1	4.29.0	GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx (fixed in 4.28.7)
baseline-browser-mapping	browserslist	2.10.9	2.11.25	GHSA-w5vr-8v7q-w6rv (fixed in 2.11.0)

browserslist 4.29 raises the minimum on its own data dependencies, so caniuse-lite (1.0.30001780 → 1.0.30001810), electron-to-chromium (1.5.321 → 1.5.433), node-releases (2.0.36 → 2.0.56) and update-browserslist-db (1.2.3 → 1.3.3) move with it. That is also what carries baseline-browser-mapping past its advisory.

About the command:

• --before=2026-09-21 is a one-week supply-chain cooldown. It takes the newest in-range versions published at least 7 days ago instead of whatever landed today (browserslist 4.29.2 was published today). Everything picked is still past the fixed versions.
• npm@11.19.1 matches the npm that last wrote this lockfile. A local npm 11.6.2 produced the same version bumps plus about 25 unrelated "peer": true flips; this version produces none.

Scope and risk

• Lockfile only. 7 package entries changed, all dev: true. No source or package.json changes. The published package has no runtime dependencies, so nothing here ships.
• Not on the build/test path. npm run build is tsc + esbuild, and Cypress serves static/ via http-server. These packages are only loaded by the webpack toolchain (npm run dev).
• Node 16 in CI. node-releases 2.0.56 declares engines: node >=18. CI installs on Node 16.14.0, where this adds one more EBADENGINE warning to the ~236 already printed (83 of them already >=18). It's a warning, not an error.
• No release. Typed build(deps-dev): so semantic-release doesn't cut a release for a dev-only lockfile change.
• Not included: js-yaml (#172) is unrelated and left for a separate change. It's the one finding npm audit still reports.

Verification

• npm ci from the new lockfile: clean
• npm audit: browserslist, fast-uri and baseline-browser-mapping no longer reported; only js-yaml (#172) remains
• npm ls: valid tree, one copy of each updated package
• npm audit signatures: 1120 packages with verified registry signatures, 141 with verified attestations
• npm run build: passes, static/cdn.js 5.3kb
• npm run format:check: clean
• Smoke tests on the updated packages:
  • npx webpack with the repo config compiles. Webpack validates its options through schema-utils → ajv → fast-uri.
  • The browserslist 4.29.0 CLI resolves defaults, maintained node versions and baseline widely available.
  • ajv cross-schema $ref resolution works through fast-uri 3.1.8.

🤖 Generated with Claude Code