build(deps-dev): bump browserslist from 4.28.1 to 4.28.9 - #929
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.1 to 4.28.9. - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.1...4.28.9) --- updated-dependencies: - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
✅ Deploy Preview for phillips-seldon ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
davidicus
left a comment
davidicus
left a comment
There was a problem hiding this comment.
@dependabot squash and merge
![phillips-pr-review-agent[bot]](https://avatars.githubusercontent.com/u/12517380?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependabot: browserslist 4.28.1 → 4.28.9
I would approve this PR (operating in safe mode, so posting as COMMENT).
What changed
Only package-lock.json is touched. package.json is unchanged — the existing version range already covers 4.28.9. The lock file update pulls in new resolutions for five transitive packages:
| Package | Old | New |
|---|---|---|
browserslist |
4.28.1 | 4.28.9 |
baseline-browser-mapping |
2.9.19 | 2.11.21 |
caniuse-lite |
1.0.30001769 | 1.0.30001810 |
electron-to-chromium |
1.5.286 | 1.5.422 |
node-releases |
2.0.27 | 2.0.54 |
update-browserslist-db |
1.2.3 | 1.3.2 |
Security relevance
Two security-adjacent fixes are included in this range:
- 4.28.2 — prototype pollution fix (
fix prototype pollutionby@chluo1997). Althoughbrowserslistis a dev-only tool (build/lint pipeline, not shipped to users), prototype pollution in a build-time dependency can still be exploited in compromised CI environments or via maliciouspackage.jsonqueries. Picking this up promptly is the right call. - 4.28.7 — unbounded memory growth + prototype write fix. These are correctness/stability fixes for the query engine, relevant to anyone running
browserslistin a long-lived Vite/PostCSS watch process.
Risk assessment
- Dev-only (
"dev": trueon all updated packages). None of these packages appear in the publisheddist/bundle. - All bumps are patch/minor within already-declared semver ranges — no API surface changes expected.
node-releases2.0.54 addsengines: { node: ">=18" }. The repo's CI already targets Node 18+, so this is consistent.baseline-browser-mappingcli bin renamed fromdist/cli.js→dist/cli.cjs— internal tooling only, no consumer impact.
No concerns. This is a clean, low-risk security maintenance bump.
|
Important Testing in progress…🟢 UI Tests: 502 tests unchanged |
|
Tip All tests passed and all changes approved!🟢 UI Tests: 502 tests unchanged |
|
🚀 Storybook preview is ready. • Preview: https://68b9f094608b90f3cfec5a06-ggrjdahesq.chromatic.com/ |
Dependency Upgrade Risk Assessment:
|
| Version | Change |
|---|---|
| 4.28.9 | Improved or query parsing performance |
| 4.28.8 | Fixed including kaios in baseline queries |
| 4.28.7 | Improved parsing performance, fixed unbounded memory growth, fixed prototype write issue |
| 4.28.6 | Fixed Electron version queries |
| 4.28.5 | Fixed > and >= query operators |
| 4.28.4 | Fixed SyntaxError regression introduced in 4.28.3 |
| 4.28.3 | Fixed baseline query case-insensitivity |
| 4.28.2 | Fixed prototype pollution |
Risk Rationale
Why LOW:
- Dev-only dependency —
browserslistruns at build time and is never shipped in the compileddist/. Regressions are caught at build/CI time before reaching downstream consumers. - Patch-level bump — All changes remain within
4.28.x; no new API surface, no removed functionality, no breaking changes. - Bug fixes for niche edge cases — The corrected query operators (
>,>=,or, KaiOS, Electron) address configurations seldon almost certainly doesn't use, since no explicit browserslist config was found in the repo. The default/inherited browser query is unaffected. - Self-healing patch train — The brief 4.28.3
SyntaxErrorregression was fixed by 4.28.4, and 4.28.9 is stable. - Implicit usage = low exposure — Since browserslist is consumed by default through Vite/Storybook tooling rather than through hand-crafted queries, the fixed edge cases have minimal chance of altering the resolved browser list.
Regression Tests
Please confirm before merging:
- Run
npm run build— verifies the library compiles without errors - Spot-check
dist/CSS output for a few components that use vendor-prefixed properties (flex,transform,grid,animation) — confirm no unexpected prefix additions or removals - Run
npm run test— all unit tests pass - Run
npm run lint:styles— Stylelint (which also reads browserslist) passes cleanly - Run
npm run build:storybook— Storybook build completes successfully - If a
.browserslistrcorbrowserslistconfig is added to the repo in the future, re-evaluate any pending browserslist upgrades before merging
Generated by Claude Code
2 participants
Bumps browserslist from 4.28.1 to 4.28.9.
Release notes
Sourced from browserslist's releases.
Changelog
Sourced from browserslist's changelog.
Commits
12ed525Release 4.28.9 versionb1d8cf9Update dependencies21517b6Improveorparsing performancef2f2e6cRelease 4.28.8 versiond0787c8Update dependenciesfcf8fa9Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream57ecd64fix: support "including kaios" without downstream093a0f6Update EM bannerb637868Release 4.28.7 version313f465Update dependenciesMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.