Security patch for the 1.5 line. No functional change.
Security
Clears two HIGH advisories against browserslist (<= 4.28.6), by bumping it to 4.28.8:
| Advisory | Summary |
|---|---|
| GHSA-73wf-gq98-2v4g | Uncaught crash / prototype write via untrusted browserslist input |
| GHSA-c83g-rgw3-j3cx | Unbounded memory growth (no cache eviction) via distinct queries |
Both were surfaced by the scheduled re-scan of supported releases, which checks published releases against current advisory data — a release is immutable, so a vulnerability that becomes fixable after it ships is otherwise invisible until an operator scans it themselves.
The change is web/package-lock.json only, 23 lines. It was written directly on the release branch rather than cherry-picked: the fix reached main as part of a full lockfile regeneration during the v1.6.0 work, and picking that commit would have dragged a whole minor's dependency tree onto this line, which is the opposite of what a patch is for.
Upgrading
A drop-in replacement for v1.5.4 — no configuration, schema, API or Helm-value change.
If you are able to move to v1.6.0 instead, prefer that: it carries the same fix along with Vault as a variable value source, rule-based variable-set assignment, and role reach previews. This release exists for operators who need the fix without the minor.
Full Changelog: v1.5.4...v1.5.5