[Gaurav0]

Summary

Every browserslist release that fixes CVE-2026-73088 and CVE-2026-73089 (>= 4.28.7) depends on node-releases >= 2.0.51. node-releases has declared engines node >= 18 since 2.0.45, so yarn refuses to install the patched tree on Node 16. This raises the minimum to Node 18 so the later parts of this stack can install.

• package.json: engines.node goes from >= 16 to >= 18.

• .github/workflows/ci.yml: every CI job runs on Node 18 instead of 16.

• .github/workflows/ci.yml: the pull_request trigger now uses branches: '**' instead of '*'. '*' does not match branch names containing a slash, so PRs stacked on gaurav/chore/... branches never ran CI. Without this, Parts 2-9 would have no checks until the PR below them merged.

No dependency changes.

Breaking for consumers still building on Node 16.

Stack

Part of the SCF-2415 audit work, split from gaurav/chore/SCF-2415-audit-critical-high for easier review. This is part 1 of 9 and targets scf_master.

Part	PR	Title
1	#6	Drop Node 16, require Node 18
2	#7	Remove release-it and release-it-lerna-changelog
3	#8	Move API docs tooling into docs/
4	#9	Dedupe Ember tooling (ember-auto-import 2, ember-source-channel-url 3)
5	#10	Upgrade Babel to 7.29 and force browserslist 4.29.5
6	#11	Force patched tmp, brace-expansion, minimatch, picomatch and braces
7	#12	Force patched fast-uri, nanoid, markdown-it, lodash.template and ansi-html
8	#13	Refresh dev-server and networking dependencies
9	#14	Refresh remaining vulnerable dependencies

Review notes

Review the CI matrix change and the engines bump, and confirm that dropping Node 16 is acceptable.

Testing

yarn install --frozen-lockfile passes on this branch. The full suite (yarn lint, ember test) was run on the top of the stack (Part 9): 0 lint errors, 526 passed, 10 skipped, 0 failed.

🤖 Generated with Claude Code