chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 8 open Dependabot security alerts by bumping vulnerable transitive dependencies via yarn resolutions

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#309	browserslist	high	Bumped to 4.28.9 via resolutions
#307	fast-uri	high	Bumped to 3.1.7 via resolutions
#306	fast-uri	high	Bumped to 3.1.7 via resolutions
#305	qs	medium	Bumped to 6.16.0 via resolutions
#304	fast-uri	high	Bumped to 3.1.7 via resolutions
#303	fast-uri	high	Bumped to 3.1.7 via resolutions
#302	@humanfs/node	medium	Bumped to 0.16.8 via resolutions
#301	postcss-selector-parser	low	Bumped to 7.1.6 via resolutions

[Copilot]

🟡 Changes recommended

Several security-related resolutions use version ranges that still allow pre-patched versions, which can reintroduce the vulnerability if the lockfile is regenerated.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the project’s Yarn dependency graph to address multiple Dependabot security alerts by forcing patched versions of vulnerable transitive dependencies via package.json resolutions and an updated yarn.lock.

Changes:

• Updated Yarn resolutions to steer vulnerable transitive packages toward patched versions (e.g., fast-uri, qs, @humanfs/node, browserslist, postcss-selector-parser).
• Refreshed yarn.lock to reflect the new resolved dependency versions (including new/updated transitive entries required by the bumps).

File summaries

File	Description
package.json	Updates resolutions to force safer transitive dependency versions.
yarn.lock	Locks the resolved dependency versions corresponding to the updated resolutions.

Review details

Suppressed comments (2)

package.json:227

• The browserslist resolution targets ^4.28.7, which still allows versions below the patched 4.28.9 mentioned in the PR description. Pin this resolution to 4.28.9 (or at least ^4.28.9) to ensure the vulnerable range can’t be reintroduced on reinstall.

        "browserslist@npm:^4.24.0": "^4.28.7",

package.json:229

• The postcss-selector-parser resolution value ^7.1.3 can still select versions older than the patched 7.1.6 referenced in the PR description if the lockfile changes. Pin to 7.1.6 to keep the security fix stable across installs.

        "postcss-selector-parser@npm:^7.0.0": "^7.1.3"

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jonathannorris]

@copilot please re-review

[Copilot]

@copilot please re-review

Addressed in d0a4a85: pinned fast-uri resolution to 3.1.7 (no range) and updated yarn.lock accordingly.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	d0a4a85	Sep 08 2026, 02:31 PM