[hero-daria]

No description provided.

[greptile-apps]

Confidence Score: 4/5

[High risk] Updates multiple dependencies to patch security vulnerabilities.

The PR should not merge until the missing resolve-dir dependency entries are restored.

Findings

1.  Browserslist crosses major versions ▶

Fix with agent prompt

### Issue 1
package.json:78
This override gives `babel-preset-env@1.7.0` Browserslist 4.29.3, even though that preset requests `^3.2.6`. The legacy Babel build path now relies on behavior outside its declared compatibility range, which risks changing the browser targets used for transpilation. Keep a compatible v3 resolution for that consumer, or verify and migrate it.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR pins several transitive dependencies to updated versions and refreshes their lockfile entries. The lockfile also drops required dependencies from resolve-dir, and the new Browserslist override crosses a legacy consumer’s major-version range.

_{Reviews (1) · Last reviewed commit: "chore: CVEs fixes"}

[greptile-apps]

Browserslist crosses major versions

This override gives babel-preset-env@1.7.0 Browserslist 4.29.3, even though that preset requests ^3.2.6. The legacy Babel build path now relies on behavior outside its declared compatibility range, which risks changing the browser targets used for transpilation. Keep a compatible v3 resolution for that consumer, or verify and migrate it.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 78

Comment:
**Browserslist crosses major versions**

This override gives `babel-preset-env@1.7.0` Browserslist 4.29.3, even though that preset requests `^3.2.6`. The legacy Babel build path now relies on behavior outside its declared compatibility range, which risks changing the browser targets used for transpilation. Keep a compatible v3 resolution for that consumer, or verify and migrate it.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Comments Outside Diff

These findings could not be posted inline.

•  Missing resolve-dir dependencies yarn.lock:7511 ▶

  The resolve-dir entry no longer lists expand-tilde or global-modules, although it requires both when loaded. On a fresh install using this dependency graph, global-modules can be omitted because nothing else in the lockfile requires it. Build or test tooling that loads resolve-dir then fails with MODULE_NOT_FOUND. Restore both dependency entries.

  resolve-dir@^1.0.0, resolve-dir@^1.0.1:
    version "1.0.1"
    resolved "https://registry.yarnpkg.com/resolve-dir/-/resolve-dir-1.0.1.tgz#79a40644c362be82f26effe739c9bb5382046f43"
    integrity sha512-R7uiTjECzvOsWSfdM0QKFNBVFcK27aHOUwdvK53BcW8zqnGdYp0Fbj82cy54+2A4P2tFM22J5kRfe1R+lM/1yg==
    dependencies:
      expand-tilde "^2.0.0"
      global-modules "^1.0.0"