[saquibrashid]

Summary

The jsdom hold landed in #426 with versions: ['>=28']. That bound was an
assumption about where the accname whitespace regression began, not a
measurement — and it was wrong. The gap let Dependabot immediately raise #427
(jsdom 25.0.1 → 27.4.0).

#427 failed jobs 4 · test:unit + coverage and 6 · test:web with exactly
the same five tests as the jsdom 30 PR:

• T-UX-145c — the trigger counts active filter values but not the search term
• T-AVREV-009a — two labelled sections, each row with its fact, as-of date and answers
• T-PHONE-005a — every chip is a native checkbox that writes the URL
• T-PHONE-005b — Reset clears every filter but keeps the search text
• T-TOOLBAR-002b — an active filter is shown by count and state, but search alone is not

Test Files 4 failed | 104 passed (108) · Tests 5 failed | 1619 passed (1624)

⚠ The other ten jobs passed on that same commit, including
9 · test:a11y — Playwright against real browsers. That is the identical
jsdom-red / real-browser-green split documented in #426, and it carries the
identical conclusion: the markup in FilterBar.tsx is correct and the
simulation is not. FilterBar.tsx is therefore unchanged here.

So the first bad major is 27, not 28. jsdom 26 remains known good (the
upstream report reproduces clean on 26.1.0), so the cap stays as small as the
evidence supports.

Linked issue / task

Closes #427. Corrects the cap introduced in #426 (which closed #405).

Type of change

• Feature (a backlog task)
• Bug fix — a wrong bound in the Dependabot hold
• Refactor / internal
• Docs / specs
• Infrastructure (infra/**) — .github/dependabot.yml

Testing done

Dependabot configuration and documentation only; no acceptance criterion
changes, so no AC → test mapping applies (specs/testing.md §10).

Gates run locally on this branch:

Command	Result
npm run format:check	passed — "All matched files use Prettier code style!"
python -c "import yaml; ..." (parse .github/dependabot.yml)	passed — jsdom now parses as {'versions': ['>=27']}; all 8 ignore entries intact

The evidence for the bound itself is CI on #427, linked above
(run 37818405831): 10 jobs green, jobs 4 and 6 red on the 5 named tests.

T-INFRA-018d reads only package.json, .nvmrc and Dockerfile, so
changing a dependabot.yml ignore bound does not affect it.

Checklist

• Every acceptance criterion touched maps to a named test that passes. — none touched.
• No new telemetry/analytics dependency (dependency allow-list, TASK-004). — no dependency change.
• No secret, credential, connection string, blob URL or SAS in code, logs, or responses.
• Any new runtime dependency is justified against NFR-004 in this description. — none added.
• Migrations contain no destructive statement (T-MIG-001). — no migrations.
• No scheduler / TTL / Agent-job / Elastic-job added (REQ-028, REQ-041).
• If I edited an executable instruction in a doc, I corrected it in place and struck through the superseded text (the F-001 rule). — both the dependabot.yml comment and runbook §5 carry the corrected bound first, with the superseded >=28 sentence struck through below it.