chore(deps): bump the npm_and_yarn group across 2 directories with 6 updates by dependabot[bot] · Pull Request #66 · clFaster/ExcaStoneBoard

dependabot · 2026-09-19T11:20:58Z

Bumps the npm_and_yarn group with 3 updates in the / directory: baseline-browser-mapping, browserslist and postcss.
Bumps the npm_and_yarn group with 3 updates in the /e2e directory: ip-address, js-yaml and undici.

Updates baseline-browser-mapping from 2.10.43 to 2.11.25

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.

refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @swwind for the idea!

refactor: Some common functions have been moved to a util.ts module for use in other scripts.

fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

719bf7a Patch to 2.11.25 because browser or feature data changed
c4f5b49 Browser or feature data changed
aa194af Updating static site
0d33c4a Patch to 2.11.24 because browser or feature data changed
1dac891 Browser or feature data changed
aff3369 Updating static site
ebdc72f Patch to 2.11.23 because browser or feature data changed
55fa3a1 Browser or feature data changed
5ac60db Updating static site
af7c3c4 Patch to 2.11.22 because browser or feature data changed
Additional commits viewable in compare view

Updates browserslist from 4.28.6 to 4.29.0

Release notes

Sourced from browserslist's releases.

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

Changelog

Sourced from browserslist's changelog.

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improved or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

Commits

e6dd578 Release 4.29.0 version
8987b7d Typo
47fefe6 Move from actions-up to pnpm
17b1e23 Update dependencies
df16b26 Merge pull request #944 from fzlzjerry/fix/757-query-continuations
a2673d7 Support query continuations across entries
f46a5b7 Merge pull request #942 from agilgur5/fix-docs-typo-security-table
989c8c9 docs: fix typo in table rendering for SECURITY.md
12ed525 Release 4.28.9 version
b1d8cf9 Update dependencies
Additional commits viewable in compare view

Updates postcss from 8.5.19 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

Changelog

Sourced from postcss's changelog.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

Commits

e544bff Release 8.5.28 version
f8fc252 Typo
5039fd7 Add missed release notes
ae40ca4 Release 8.5.27 version
62b1626 Fix linter
1dba938 Update dependencies
3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
6d23bc3 Fix link
508e997 Add GitHub Sponsors link
e993739 Add CodeRabbit sponsor (#2145)
Additional commits viewable in compare view

Updates ip-address from 10.2.0 to 10.7.2

Release notes

Sourced from ip-address's releases.

v10.7.2

What's Changed

Accept an arpa suffix in any case and without the root dot in fromArpa by @beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

Bump js-yaml and brace-expansion in the lockfile by @beaugunderson in beaugunderson/ip-address#226

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

What's Changed

Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

Honor the fromURL graceful-failure contract for non-IPv6 hosts by @beaugunderson in beaugunderson/ip-address#218

Correct the documentation where it disagreed with the library by @beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

Add GitHub Actions CI by @beaugunderson in beaugunderson/ip-address#213

Keep the package loadable on node 12, and enforce it by @beaugunderson in beaugunderson/ip-address#216

Validate the byte arrays Address6 is given by @beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

... (truncated)

Commits

974b48d 10.7.2
4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
f0c25df 10.7.1
8b34a21 Merge commit from fork
13b6155 Merge commit from fork
469ead1 Reject an address longer than the family allows before parsing it
1343629 Report an address of the other family as not contained
4c2184a Bump js-yaml and brace-expansion in the lockfile (#226)
2b7cab5 10.7.0
87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates js-yaml from 4.3.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
See full diff in compare view

Updates undici from 6.27.0 to 6.28.1

Release notes

Sourced from undici's releases.

v6.28.1

⚠️ Security fixes

High severity

GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

perf: reduce EventSourceStream parser allocations (#5032) by @mcollina in nodejs/undici#5647

[v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @mcollina in nodejs/undici#5770

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

v6.28.0

⚠️ Security fixes

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.

GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits

ffc8aa0 Bumped v6.28.1 (#5773)
3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
ce31bc8 fix(retry): validate resumed response framing
2af0faf fix(websocket): reject unrequested subprotocols
07c60d9 fix(websocket): destroy inflater after decompression limit
bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
01a912e Bumped v6.28.0 (#5591)
481ecfc Use Node 22 and npm 11 to release
740a0b7 fix: validate blob body content type
2698e49 fix: validate coerced header values for CRLF (#5579)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 3 updates in the / directory: [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping), [browserslist](https://github.com/browserslist/browserslist) and [postcss](https://github.com/postcss/postcss). Bumps the npm_and_yarn group with 3 updates in the /e2e directory: [ip-address](https://github.com/beaugunderson/ip-address), [js-yaml](https://github.com/nodeca/js-yaml) and [undici](https://github.com/nodejs/undici). Updates `baseline-browser-mapping` from 2.10.43 to 2.11.25 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.43...v2.11.25) Updates `browserslist` from 4.28.6 to 4.29.0 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.6...4.29.0) Updates `postcss` from 8.5.19 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.19...8.5.28) Updates `ip-address` from 10.2.0 to 10.7.2 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.7.2) Updates `js-yaml` from 4.3.0 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) Updates `undici` from 6.27.0 to 6.28.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.27.0...v6.28.1) --- updated-dependencies: - dependency-name: baseline-browser-mapping dependency-version: 2.11.25 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.29.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.28 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.7.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.28.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 19, 2026

dependabot Bot mentioned this pull request Sep 19, 2026

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #65

Closed

codescene-delta-analysis Bot approved these changes Sep 19, 2026

View reviewed changes

clFaster enabled auto-merge September 19, 2026 11:27

clFaster merged commit 6826d95 into main Sep 19, 2026
7 checks passed

clFaster deleted the dependabot/npm_and_yarn/npm_and_yarn-1ef8039c2a branch September 19, 2026 11:28

Navigation Menu

chore(deps): bump the npm_and_yarn group across 2 directories with 6 updates - #66

chore(deps): bump the npm_and_yarn group across 2 directories with 6 updates#66
clFaster merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-1ef8039c2a

dependabot Bot commented on behalf of github Sep 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 19, 2026

v2.11.0

What's Changed in 2.11.0

4.29.0

4.28.9

4.28.8

4.28.7

4.29.0

4.28.9

4.28.8

4.28.7

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

v10.7.2

What's Changed

v10.7.1

What's Changed

v10.7.0

What's Changed

v10.6.0

What's Changed

v10.5.1

v10.5.0

What's Changed

v10.4.0

What's Changed

v10.3.1

4.3.2 - 2026-08-26

Changed

Security

4.3.1 - 2026-07-31

Security

v6.28.1

⚠️ Security fixes

High severity

Medium severity

Low severity

What's Changed

v6.28.0

⚠️ Security fixes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant