fix(deps): drop unused remark-mdx-frontmatter and bump browserslist override

[AndreyHirsa]

Closes three high-severity Dependabot alerts: 1315 (toml, prototype pollution, CVSS 8.2) and 1316 / 1317 (browserslist, uncaught crash plus prototype write, and unbounded cache growth, CVSS 7.5 each).

toml reached us only through remark-mdx-frontmatter, which packages/cli/src/cli/loaders/mdx.ts imported but never used — the two .use(remarkMdxFrontmatter) calls were dropped in #656 and the import line was left behind. Removing the import and the dependency takes toml out of the tree entirely, including for anyone running npm i lingo.dev, which a pnpm override cannot do. browserslist is deep transitive under Babel, autoprefixer and cssnano, so it gets an override to >=4.28.8 <5; every dependent already asks for ^4.2x, so this is a patch bump inside ranges they already declare.

Full monorepo build passes (19/19 tasks, including the Next 16 and Vite demos) and so do the tests (20/20 tasks — 955 CLI, 244 compiler). pnpm audit reports no remaining high-severity findings.

Summary by CodeRabbit

• Bug Fixes

  • Improved dependency compatibility by constraining the supported Browserslist version range.
  • Removed an unused MDX processing dependency without changing user-facing functionality.

• Chores

  • Updated project release metadata to document the dependency cleanup.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Essentials

Run ID: 30296198-84ab-405f-8f79-ad1088494349

📥 Commits

Reviewing files that changed from the base of the PR and between b05bc64 and 73b2c31.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• .changeset/quiet-pugs-invite.md
• packages/cli/package.json
• packages/cli/src/cli/loaders/mdx.ts
• pnpm-workspace.yaml

💤 Files with no reviewable changes (2)

• packages/cli/package.json
• packages/cli/src/cli/loaders/mdx.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR removes the unused remark-mdx-frontmatter import and dependency from the CLI MDX loader, records the cleanup in a patch changeset, and constrains browserslist through a pnpm workspace override.

Changes

MDX dependency cleanup

Layer / File(s)	Summary
Remove unused MDX dependency .changeset/quiet-pugs-invite.md, packages/cli/package.json, packages/cli/src/cli/loaders/mdx.ts	The unused import and runtime dependency were removed. A patch changeset documents the cleanup.

Browserslist version override

Layer / File(s)	Summary
Constrain browserslist version pnpm-workspace.yaml	The workspace now restricts browserslist to versions >=4.28.8 <5.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 73b2c

This removes an unused MDX dependency and constrains browserslist to the intended patched version, with no current merge-readiness risk identified.

Suggested reviewers: ohmoses

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies both primary changes: removing the unused remark-mdx-frontmatter dependency and updating the browserslist override.
Description check	✅ Passed	The description clearly explains the security issues, code changes, dependency impact, and validation results. It does not use the repository template headings or checklist format, but it contains the…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/deps-browserslist-toml-advisories

---

_{Comment @coderabbitai help to get the list of available commands.}