fix(deps): bump xmldom to 0.8.15 and browserslist to 4.28.8

[revopushbot]

Lockfile-only. Clears the two remaining npm audit findings on main.

1. @xmldom/xmldom 0.8.13 → 0.8.15 — the other half of CVE-2026-83610

GHSA-6gmq-8vp8-gcm6 is CVE-2026-83610 (confirmed via the GitHub advisory API: cve_id: CVE-2026-83610), and it spans two release lines:

affected range	first patched
>= 0.7.0, <= 0.8.14	0.8.15
>= 0.9.0, <= 0.9.11	0.9.12

This repo carries a copy on each line, so the CVE needs both bumps:

• node_modules/@xmldom/xmldom 0.8.13 → 0.8.15 — this PR
• node_modules/plist/node_modules/@xmldom/xmldom 0.9.10 → 0.9.12 — fix(deps): bump @xmldom/xmldom to 0.9.12 to resolve CVE-2026-83610 #16

#16's description originally framed the 0.8.x copy as "outside the affected range" and "a different advisory". That was wrong and is corrected in a comment there. Both PRs must land before CVE-2026-83610 is actually closed for this repo.

The advisory's third affected package, the legacy unscoped xmldom (<= 0.6.0, no patch available), is not present in this tree.

2. browserslist 4.28.5 → 4.28.8 — unrelated, high severity

GHSA-c83g-rgw3-j3cx (unbounded memory growth, no cache eviction → eventual OOM) and GHSA-73wf-gq98-2v4g (uncaught crash / prototype write via untrusted browserslist-stats.json). Both affect <= 4.28.6, first patched in 4.28.7; this takes 4.28.8.

4.28.8 raises its own dependency floors, so five packages in its chain move with it. This is required by the bump, not scope creep:

package	from	to	required floor
baseline-browser-mapping	2.10.42	2.11.21	^2.11.12
caniuse-lite	1.0.30001803	1.0.30001810	^1.0.30001809
electron-to-chromium	1.5.388	1.5.422	^1.5.402
node-releases	2.0.50	2.0.54	^2.0.53
update-browserslist-db	1.2.3	1.3.2	^1.3.0

Why this can't break consumers

Lockfiles are not published to consumers — npm ignores a dependency's lockfile, so downstream apps resolve @revopush/expo-code-push-plugin purely from its package.json ranges, which are untouched. The blast radius is this repo's own CI and dev installs.

Verification

• All 17 declared ranges across the 7 bumped packages resolve and satisfy — checked with semver against npm's real node_modules walk-up, including update-browserslist-db's browserslist@">= 4.21.0" peer dep. Zero unsatisfied.
• No engines constraint changed on any of the 7. The tightest is node-releases@>=18; CI's Node 20.19.4 satisfies all.
• Lock is converged — re-running npm install --package-lock-only produced no further changes.
• Not a regeneration. Parsing packages from both lockfiles gives an identical key set — no entries added or removed, exactly 7 versions differing. The 52 changed lines in package-lock.json are 7 × 3 fields (version/resolved/integrity) + browserslist's 5 dependency-range lines; yarn.lock's 62 are those same 26 plus 5 entry headers, since yarn keys entries by semver range.
• Every yarn.lock integrity value was checked against the registry — all 7 match.

npm ci + npm run build + npm run lint were still running locally when this PR was opened (the registry has been very slow — its audit endpoint returned 503 Service Unavailable earlier). CI runs exactly that on this PR, so its result is authoritative here.

🤖 Generated with Claude Code

https://claude.ai/code/session_018Ds7MWC2WZfwe6X5mwJV12

[revopushbot]

Local CI replication finished — resolving the "still running" caveat in the description. All green:

npm ci          -> exit 0   (added 1143 packages, audited 1144, in 5m)
npm run build   -> exit 0
npm run lint    -> exit 0   (192 prettier warnings, 0 errors)

npm ci passing is the meaningful one: it installs strictly from the lockfile and verifies every integrity hash against the real tarballs, so the 7 bumped entries all resolve.

The 192 lint warnings are pre-existing prettier/prettier formatting warnings in src/, unrelated to this PR — it is lockfile-only and touches no source. Lint exits 0.

Remaining audit finding on this branch is expected

npm ci reports 1 moderate severity vulnerability. That is the nested plist → @xmldom/xmldom@0.9.10 — the 0.9.x half of CVE-2026-83610 — because this branch was cut from main before #16 merged.

#16 has since merged. Current origin/main and this branch compose to a fully patched tree:

copy	origin/main	+ this PR
node_modules/@xmldom/xmldom	0.8.13 (vulnerable)	0.8.15 ✅
node_modules/plist/node_modules/@xmldom/xmldom	0.9.12 ✅ (from #16)	0.9.12 ✅

Verified this branch merges cleanly into current main (git merge-tree — no conflicts), so both halves of CVE-2026-83610 are closed once this lands.