build(deps): bump baseline-browser-mapping from 2.10.7 to 2.11.22 - #4399
dependabot[bot] wants to merge 2 commits into
Conversation
Bumps [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) from 2.10.7 to 2.11.22. - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.7...v2.11.22) --- updated-dependencies: - dependency-name: baseline-browser-mapping dependency-version: 2.11.22 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — mechanical dependabot lockfile bump.
What was reviewed: the yarn.lock diff, confirming it only changes the resolved version/integrity of the transitive baseline-browser-mapping dependency (2.10.7 to 2.11.22) with no other lockfile entries or source files touched. This is a caret-range (^2.9.0) update within semver, and the release notes cited in the PR description indicate the bump includes a CVE fix (process.exit() removal), not new risk.
Extended reasoning...
Overview
The diff is confined to a single file, yarn.lock, and within it to one dependency entry: baseline-browser-mapping, bumped from 2.10.7 to 2.11.22 along with its integrity checksum. No package.json, source, or config files are touched. This is a routine dependabot-authored dependency update.
Security risks
None identified. The dependency is used as a browserslist-mapping data package (build tooling), not runtime-critical or security-sensitive code such as auth or crypto. The version change stays within the existing caret range constraint (^2.9.0), so it is a compatible semver update per the declared range. The upstream release notes referenced in the PR description even describe a fix for a minor CVE (removal of process.exit() in favor of throwing errors), which is a risk reduction rather than an increase.
Level of scrutiny
This warrants minimal scrutiny: it is a single-line lockfile version/checksum bump for a transitive dependency, mechanical and auto-generated by dependabot, with no hand-written code changes to review. The bug-hunting system found no issues, consistent with the trivial nature of the change.
Other factors
No CODEOWNERS restrictions apply to yarn.lock in this repo (none found), and there is no outstanding reviewer objection in the conversation timeline. The change is self-contained and easily reversible if the new version caused any regression.
There was a problem hiding this comment.
Looks good, mechanical dependency bump.
What was reviewed: the sole change is a yarn.lock entry bumping baseline-browser-mapping from 2.10.7 to 2.11.22, with the checksum updated to match. Confirmed no source files changed and the version/checksum pair line up with the new resolution.
Extended reasoning...
Overview
The diff touches only yarn.lock, updating the resolved version of the transitive dependency baseline-browser-mapping from 2.10.7 to 2.11.22 and its checksum accordingly. No application source files are part of this change.
Security risks
None identified. This is a lockfile-only update for a build-time browser-compat-data package; there is no code path in this repo that consumes attacker-controlled input through this dependency differently as a result of the version bump. The upstream release notes (per the PR description) mention a fix removing process.exit() calls in favor of thrown errors, which is a hardening change in the dependency itself, not a regression introduced here.
Level of scrutiny
Low. This is exactly the kind of mechanical, single-line lockfile change (version + checksum bump via Dependabot) that does not warrant a human hold-up. No CODEOWNERS restrictions apply to yarn.lock in this repo, and no design decisions are involved.
Other factors
A prior automated review already commented on an earlier push of this PR, and a follow-up commit was pushed afterward. The current diff (which is all that changed against the base) is a clean, minimal version bump with matching checksum, and no CHANGES_REQUESTED or unresolved objection is evident from the timeline metadata. Given the trivial and self-contained nature of the change, approval is appropriate.
This branch has not been deployed
1 participant
Bumps baseline-browser-mapping from 2.10.7 to 2.11.22.
Release notes
Sourced from baseline-browser-mapping's releases.
Commits
af7c3c4Patch to 2.11.22 because browser or feature data changed7e10cadBrowser or feature data changedebb9702Updating static siteecc57a3Updating static site0e5ed80Patch to 2.11.21 because browser or feature data changed11da0b6Browser or feature data changed69fcc81Updating static siteb964de0Patch to 2.11.20 because browser or feature data changed723099fBrowser or feature data changedf44163dUpdating static siteDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.