chore(deps): consolidate example security bumps

[ntucker]

Pins patched versions in the standalone example npm lockfiles (todo-app, github-app, nextjs). Workspace Yarn security bumps already landed in #4083; this is the example-app follow-up those PRs were left for.

Supersedes:

• #4088 js-yaml 4.3.2 (github-app)
• #4087 / #4086 next (nextjs)
• #4085 sharp 0.35.4 (nextjs)
• #4084 baseline-browser-mapping (todo-app)
• #4082 svgo (github-app)
• #4081 browserslist (todo-app)
• #4080 browserslist (nextjs)
• #4078 fast-uri (todo-app)
• #4077 fast-uri (github-app)
• #4076 postcss-selector-parser (github-app)
• #4073 postcss-selector-parser (todo-app)

Please close those after this merges. Dependabot should auto-close most of them.

Motivation

Each example keeps its own npm lockfile (not a Yarn workspace). Dependabot/Renovate opened one security PR per package per app. Same GHSA class as #4083, split across 12 PRs.

Solution

In-range lockfile pins where parent ranges already allow the patched release. One new override: qs >=6.16.0 in todo-app and github-app, because express / body-parser request qs@~6.15.1 (same reason as the workspace resolution in #4083).

postcss-selector-parser 6.x stays on the v6 line (6.1.4) instead of Dependabot’s 6 → 7 jump in #4073. 7.x goes to 7.1.6 (includes the later CPU-exhaustion fix). next lockfile is 15.5.25 (15.5.24 plus a later patch).

Package	Before	After	Apps	Advisories
next	15.5.21	15.5.25	nextjs	GHSA-p293-qw3h-jr36, GHSA-2xp9-vwfh-vxw4
js-yaml	4.3.1	4.3.2	github-app, todo-app	GHSA-2883-xcg3-v3hh
browserslist	4.28.2	4.28.9	all three	GHSA-c83g-rgw3-j3cx, GHSA-73wf-gq98-2v4g
baseline-browser-mapping	2.10.x	2.11.22	all three	GHSA-w5vr-8v7q-w6rv / CVE-2026-45819
fast-uri	3.1.5	3.1.7	github-app, todo-app	GHSA-qw65-cvwx-89v3 and related v3 advisories
postcss-selector-parser	6.1.2 / 7.0–7.1.1	6.1.4 / 7.1.6	github-app, todo-app	GHSA-w9m9-85wc-3x92, GHSA-rj75-hqrm-r3gf
svgo	3.3.4 / 4.0.2	3.3.5 / 4.1.0	github-app, todo-app	GHSA-4vpr-x523-8j87, GHSA-w27v-7q3p-w38r
sharp	0.35.3	0.35.4	nextjs	Dependabot security update
nanoid	3.3.16	3.3.19	all three	GHSA-2v37-7h3g-55p8 (fixed in 3.3.18)
qs	6.15.2	6.16.0	github-app, todo-app	GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g

No published @data-client/* packages. No changeset.

Intentionally not bumped

Package	Why
elliptic / crypto-browserify (via @anansi/webpack-config 21.x)	npm audit’s “fix” is a semver-major downgrade to webpack-config 4.2.5.
colord <2.9.4	Moderate ReDoS; not in the open security PRs.

Testing

• npm audit: nextjs 0 vulnerabilities. github-app / todo-app remaining hits are the skipped webpack-config / colord items.
• Smoke-require the patched packages from each example lockfile.

  

[changeset-bot]

⚠️ No Changeset found

Latest commit: 58cdbaa

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs-site	Ignored		Sep 10, 2026 10:30pm UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.84%. Comparing base (1217fbe) to head (58cdbaa).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4089   +/-   ##
=======================================
  Coverage   97.84%   97.84%           
=======================================
  Files         156      156           
  Lines        3057     3057           
  Branches      612      612           
=======================================
  Hits         2991     2991           
  Misses         18       18           
  Partials       48       48           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.