Update frontend transitive dependencies

[mlim19]

Summary

Adds resolutions entries in src/gprofiler/frontend/package.json to pull four transitive frontend dependencies up to their latest patch releases. All four are transitive — none are direct dependencies.

Package	Before	After	Requested by
browserslist	4.28.1	4.28.9	^4.24.0 (build toolchain)
nanoid	3.3.17	3.3.18	^3.3.16 (postcss)
decode-uri-component	0.2.2	0.5.0	^0.2.2 (query-string@7)
@humanfs/node	0.16.7	0.16.8	^0.16.6 (eslint)

Only package.json and yarn.lock are touched — no source changes.

Note on decode-uri-component

Three of these are ordinary in-range patch bumps. This one is not, and is worth a look before merging:

• query-string@7 declares ^0.2.2, i.e. <0.3.0. Moving to 0.5.0 pushes it two minors past what its consumer asks for.
• decode-uri-component switched to ESM-only at 0.4.0, while query-string@7 is CommonJS. Under a bare Node require() the package now fails to load with ERR_REQUIRE_ESM.
• Vite/Rollup resolves the interop at bundle time, so the shipped app is unaffected.

Verification

• yarn build passes (2561 modules transformed)
• yarn eslint --max-warnings=0 clean
• decode-uri-component@0.5.0 spot-checked directly against how query-string calls it: percent-encoded, UTF-8 multibyte, and malformed input (%E0%A4%A, %) all decode as before
• Manual test performed

yarn install needs --ignore-engines on Node 18, since js-cookie@3.0.7 declares node >=20.

[Copilot]

🟡 Changes recommended

It force-overrides decode-uri-component to an out-of-range, ESM-only version for a CommonJS consumer (query-string@7), which can break any unbundled Node/CommonJS usage paths.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the frontend’s dependency graph by adding Yarn resolutions in src/gprofiler/frontend/package.json and regenerating yarn.lock so several transitive dependencies resolve to newer patch versions.

Changes:

• Add resolutions overrides for browserslist, nanoid, decode-uri-component, and @humanfs/node.
• Update yarn.lock to reflect the newly forced versions (including new @humanfs/types due to the @humanfs/* bump).

File summaries

File	Description
src/gprofiler/frontend/package.json	Adds Yarn resolutions to force specific transitive dependency versions.
src/gprofiler/frontend/yarn.lock	Lockfile updates reflecting the forced dependency versions and resulting sub-dependency changes.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The PR description and the actual resolutions behavior/versions are currently inconsistent (notably around decode-uri-component and “patch-only” pinning), which needs to be reconciled before merging.

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

src/gprofiler/frontend/package.json:22

• The PR description says these resolutions are intended to bump transitive deps to their latest patch versions, but using caret ranges (e.g. ^4.28.7, ^3.3.18) can allow future minor releases on the next install, so the repo may drift beyond the intended patch pins. If the goal is to pin to the specific patch versions reflected in yarn.lock, use exact versions (or ~ ranges) here; otherwise, update the PR description to match the behavior.

This issue also appears on line 20 of the same file.

src/gprofiler/frontend/package.json:21

• The PR description (and its table) states decode-uri-component is being bumped to 0.5.0, but the actual resolution and lockfile still keep it at 0.2.2 (and query-string@7.1.3 depends on ^0.2.2). Please update the PR description to avoid confusion about what’s changing and the ESM/CJS risk discussion.

    "nanoid": "^3.3.18",
    "decode-uri-component": "^0.2.2",

• Files reviewed: 1/2 changed files
• Comments generated: 0 new
• Review effort level: Lite