build(deps-dev): bump baseline-browser-mapping from 2.9.19 to 2.11.21

[dependabot]

Bumps baseline-browser-mapping from 2.9.19 to 2.11.21.

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.0

What's Changed

• Introduces support for Node 6 by refactoring all Object.entries and Object.values instances and lowering ES target in Rollup to es2015.
• Adds specified Node version support in package.json for >=6.0.0.
• Refactors CLI code to avoid parseArgs which is not supported by versions of Node prior to 18, changes import to require and changes Rollup export to cjs to allow execution on older versions of Node.
• Adds a new legacy-test.js file that allows basic testing on older versions of Node where current versions of Jasmine and ESLint are not supported.
• Adds a test matrix to run tests on all even-numbered Node versions from 6 to 24.
• refactor publish workflows to support NPM's new OIDC integration

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.24...v2.10.0

Commits

• 0e5ed80 Patch to 2.11.21 because browser or feature data changed
• 11da0b6 Browser or feature data changed
• 69fcc81 Updating static site
• b964de0 Patch to 2.11.20 because browser or feature data changed
• 723099f Browser or feature data changed
• f44163d Updating static site
• 8966043 Patch to 2.11.19 because browser or feature data changed
• e18601d Browser or feature data changed
• 28cb50a Updating static site
• cb33a83 Patch to 2.11.18 because browser or feature data changed
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for baseline-browser-mapping since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[netlify]

✅ Deploy Preview for phillips-seldon ready!

Name	Link
🔨 Latest commit	68d60d1
🔍 Latest deploy log	https://app.netlify.com/projects/phillips-seldon/deploys/6aa25ea1be9ede000856a00e
😎 Deploy Preview	https://deploy-preview-931--phillips-seldon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[davidicus]

@dependabot squash and merge

[phillips-pr-review-agent]

Dependabot dependency update — baseline-browser-mapping 2.9.19 → 2.11.21

I would approve this change.

This is a clean, automated Dependabot update with only package-lock.json modified. The package is a devDependency ("dev": true) so it has no impact on the published @phillips/seldon bundle or any consumer runtime.

Notable changes in the version range

Version	Highlight
2.10.0	Lowered ES target to es2015, added Node >=6 support, CLI refactored to CJS (dist/cli.cjs — reflected in the lockfile bin field change)
2.11.0	Security fix: CVE-2026-45819 — removes process.exit() calls in getCompatibleVersions() / getAllVersions() in favour of thrown Errors, eliminating a denial-of-service vector if unsanitised input was passed to the CLI. Also adds a new getTimeline() API and substantial internal refactoring.
2.11.1–2.11.21	Browser/feature data refreshes only (patch cadence driven by upstream web-features/BCD updates)

What changed in the lockfile

• version: 2.9.19 → 2.11.21
• integrity hash: updated correctly
• bin: dist/cli.js → dist/cli.cjs (CJS bundle, matches 2.10.0 Node-compat refactor)
• engines field added: "node": ">=6.0.0" (no conflict with this repo's Node target)

Risk assessment

• Runtime risk: None — dev-only package, not bundled into dist/.
• Security: This upgrade resolves CVE-2026-45819. The process.exit() DoS path is only reachable when calling the library's API directly (not just CLI use), but since this is a devDep used in a build/tooling context the practical exposure was already limited.
• Compatibility score: Dependabot reports a high compatibility score for this transition.

No concerns. Safe to merge.

[chromatic-com]

Important

Testing in progress…

🟢 UI Tests: 502 tests unchanged
⏳ UI Review: Comparing 251 stories…
Storybook Publish: 251 stories published

[chromatic-com]

Tip

All tests passed and all changes approved!

🟢 UI Tests: 502 tests unchanged
🟢 UI Review: 251 stories published -- no changes
Storybook Publish: 251 stories published

[github-actions]

🚀 Storybook preview is ready.

• Preview: https://68b9f094608b90f3cfec5a06-poxeonsthw.chromatic.com/
• Chromatic build: https://www.chromatic.com/build?appId=68b9f094608b90f3cfec5a06&number=751

[scottdickerson]

🤖 Dependency Risk Assessment: dependency-upgrade-risk:low

Library Summary

baseline-browser-mapping is a W3C web-platform-dx package that maps web platform features to the minimum browser versions that support them according to the "Baseline" browser support initiative (tracking Chrome, Edge, Firefox, and Safari). In seldon, it appears in package.json as a dev dependency but is not directly imported in any source file — it feeds data into a build-time or linting tool (likely the ESLint browser compat plugin or browserslist). Its scope is entirely limited to the development toolchain with no runtime presence in the published package.

What Changed (2.9.19 → 2.11.21)

This spans two minor releases plus ~21 automated patch data updates:

v2.10.0:

• Introduced Node 6 support via internal refactoring (CJS output, require instead of import, lower ES target)
• Internal build and publish workflow changes — no public API impact

v2.11.0:

• Added new getTimeline() method (purely additive, does not touch existing API)
• Substantial refactoring of the internal data compression format (replaces a full browser list with a change-list timeline)
• Changed error handling: process.exit() calls in getCompatibleVersions() / getAllVersions() replaced with thrown Errors — strictly safer behavior
• Patches 2.11.1–2.11.21: all automated "browser or feature data changed" data refreshes from MDN/web-features

Risk Rationale

• No breaking changes to the existing public API (getCompatibleVersions(), getAllVersions())
• New getTimeline() method is purely additive
• Internal data compression refactoring is transparent to consumers
• Error handling change is strictly better (allows callers to catch rather than process dying)
• Dev-only toolchain dependency with zero production runtime impact
• The automated patch data updates simply reflect newer browser release information

Codebase Usage

baseline-browser-mapping does not appear in any seldon source or config file beyond package.json — it has no surface area in the published component library. It is consumed indirectly by a build-time compatibility checking tool. Low blast radius.

Regression Test Checklist

• Run npm run lint (or equivalent) — ESLint passes with no new compatibility warnings or errors
• Run npm run build — the library builds cleanly
• Run npm run test — all component tests pass
• Run Storybook build (npm run storybook:build or equivalent) and confirm no new errors
• Confirm no unexpected new "browser compatibility" lint errors appear in existing components after the updated browser data

---

Generated by Claude Code