fix(deps): bump browserslist to 4.28.7 (high GHSA-73wf-gq98-2v4g)

[caffeine-ci-bot]

Automated fix from the security-autofix pipeline in caffeinelabs/infra.

Dependabot alert #632 — browserslist → 4.28.7 (high, GHSA-73wf-gq98-2v4g).

A coding agent (Cursor) upgraded the vulnerable dependency to the fixed
version, regenerated the lockfile, and made the minimal code changes needed to
keep the build coherent. The diff is intended to be small and obviously
correct.

Review like any PR:

• Confirm the version bump matches the advisory's fixed version and the
  lockfile change is consistent.
• Sanity-check any code edits the upgrade forced.
• Run CI. If the fix is wrong or incomplete, just close this PR — the workflow
  won't reopen it while this bot/depbot-autofix/632 PR exists, and the
  alert stays in the daily/weekly digest until it's resolved.

🤖 Generated by the security-autofix workflow via Cursor.

[github-actions]

Cursor AI review

👍 APPROVE — looks safe to merge

Category	Assessment	Details
Summary	✅	Docs-only lockfile bump: resolved browserslist in docs/package-lock.json from 4.28.1 to 4.28.9 (past the advisory floor of 4.28.7), with matching caniuse/baseline/electron-to-chromium/node-releases/update-browserslist-db updates. No application, CLI, or canister code changes.
Code Quality	✅	No new helpers or speculative code; the only extra lockfile metadata change is root packages[""].engines >=20.0 → >=22.0, which matches the already-present docs/package.json engines field (that file is not in the diff).
Consistency	✅	Isolated to the docs workspace lockfile. No CLI flags, mops.toml keys, changelog, skills, or Candid surface to keep in sync.
Security	✅	Traced the single resolved node_modules/browserslist entry (now 4.28.9 with a new integrity hash) and its dependency pins; no identity, authz, package-integrity, install/resolve, or registry paths are in the diff. The sites job in .github/workflows/ci.yml builds docs on Node 22, so the lockfile engines sync does not raise the CI runtime.
Tests	✅	No snapshot or test files changed. This is a docs lockfile-only bump with no CLI output to snapshot; ci.yml sites still runs npm run build-docs against this lockfile.
Maintainability	✅	Standard npm lockfile regeneration; no new APIs or duplicated resolution logic.

Verdict

Decision: APPROVE
Risk: Very Low
Reason: Single docs lockfile security bump with consistent transitive pins and no product-code or high-risk-path changes. Landing 4.28.9 instead of the titled 4.28.7 is a later patch on the same line and still satisfies the advisory floor.

---

Generated for commit 3dc62f8

[automation-sa-sre]

Automated approval: the AI review verdict for 3dc62f8 is APPROVE. See the "Cursor AI review" comment for details.