Bump baseline-browser-mapping from 2.9.19 to 2.11.0 - #385
Conversation
Bumps [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) from 2.9.19 to 2.11.0. - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.9.19...v2.11.0) --- updated-dependencies: - dependency-name: baseline-browser-mapping dependency-version: 2.11.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
|
@dependabot merge |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 04a93d0. Configure here.
|
|
||
| xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz: | ||
| resolution: {integrity: sha512-oLDq3jw7AcLqKWH2AhCpVTZl8mf6X2YReP+Neh0SJUzV/BdZYjth94tG5toiMB1PPrYtxOCfaoUCkvtuH+3AJA==, tarball: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz} | ||
| resolution: {tarball: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz} |
There was a problem hiding this comment.
Lockfile drops xlsx integrity hash
High Severity
The lockfile refresh removed the integrity hash from the xlsx tarball on cdn.sheetjs.com. pnpm@10.33.2 requires that field for HTTPS tarballs, so later installs can fail with ERR_PNPM_MISSING_TARBALL_INTEGRITY and the SheetJS package is no longer pin-verified against a swapped tarball.
Reviewed by Cursor Bugbot for commit 04a93d0. Configure here.
Bumps baseline-browser-mapping from 2.9.19 to 2.11.0.
Release notes
Sourced from baseline-browser-mapping's releases.
Commits
de733e2feat: add getTimeline() and refactor data compression (#137)9750868Patch to 2.10.44 because browser or feature data changed0078dceBrowser or feature data changed1844986Patch to 2.10.43 because browser or feature data changedeb1551fBrowser or feature data changed2d77ebcUpdating static site47fdbbfPatch to 2.10.42 because browser or feature data changedac15f93Browser or feature data changede77261cUpdating static site1a84ee9Patch to 2.10.41 because browser or feature data changedMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for baseline-browser-mapping since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Dev/build-time dependency bump with no runtime app code changes; includes a minor security hardening in the library’s CLI/API error handling.
Overview
Upgrades
baseline-browser-mappingfrom 2.9.19 to 2.11.0 as an explicit devDependency onsites/hacklytics2027, withpnpm-lock.yamlrefreshed so transitive consumers (e.g.browserslist,next) resolve the same version instead of older lockfile entries.The upstream release adds
getTimeline(), refactors how Baseline browser data is packaged, and replacesprocess.exit()on invalid API options with thrown errors (security fix for CVE-2026-45819). No application source changes—only dependency versions and lockfile metadata.Reviewed by Cursor Bugbot for commit 04a93d0. Bugbot is set up for automated code reviews on this repo. Configure here.