Repository navigation
refactor: Bump browserslist from 4.28.1 to 4.29.4 - #990
Conversation
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update browser compatibility dependencies package-lock.json |
The lockfile updates resolved versions and dependency ranges for browser-compatibility packages. It adds license metadata, records node-releases Node.js engine requirement >=18, and updates the corresponding legacy dependency entries. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Merge Risk: 
9c0a7
-
This updates development-only browser-compatibility dependencies in the lockfile, with no code changes and no runtime impact. No concrete merge-blocking risk was found.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title begins with the allowed prefix "refactor:" and uses a capitalized first word after the prefix. It accurately describes the browserslist dependency update in the changeset. Linked Issues check The directly linked coding objectives are met. For #981,package-lock.jsonupdatesbrowserslistfrom 4.28.1 to 4.29.4, which includes the requested 4.28.9 changes and exceeds the target version. F…Out of Scope Changes check The diff is limited to package-lock.json. It updatesbrowserslist,baseline-browser-mapping, and their related transitive browser-data packages, dependency ranges, integrity hashes, and package …Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Security Check PASS. The PR changes only package-lock.json. All six changed packages remain development-only dependencies, use npm registry URLs with integrity hashes, and add no install or runtime hooks. The update… Engage In Review Feedback No review feedback comments or actionable findings were supplied. The current review produced zero actionable findings, so there was no feedback to ignore, resolve, implement, or discuss. Full details: Linked Issues check
-
Explanation
The directly linked coding objectives are met. For
#981,package-lock.jsonupdatesbrowserslistfrom 4.28.1 to 4.29.4, which includes the requested 4.28.9 changes and exceeds the target version. For#983, the lock file updatesbaseline-browser-mappingfrom 2.9.19 to 2.11.32, which exceeds 2.11.21. The lock file also updates the requiredbrowserslistdependency closure and integrity data. The issues require dependency updates only; no additional source change or test is specified.
Full details: Out of Scope Changes check
-
Explanation
The diff is limited to
package-lock.json. It updatesbrowserslist,baseline-browser-mapping, and their related transitive browser-data packages, dependency ranges, integrity hashes, and package metadata. These changes support the two linked dependency upgrades. No unrelated source, configuration, or generated file change is present.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Full details: Security Check
-
Explanation
PASS. The PR changes only package-lock.json. All six changed packages remain development-only dependencies, use npm registry URLs with integrity hashes, and add no install or runtime hooks. The updated browserslist 4.29.4 and baseline-browser-mapping 2.11.32 are above the vulnerable ranges listed in the PR advisories. No security-related code pattern is introduced.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Closes #981
Closes #983
Bot PR #981 targeted browserslist 4.28.9. browserslist 4.29.0 to 4.29.4 were released after that PR was opened, and
npm update browserslistnow resolves to 4.29.4, so this PR upgrades to 4.29.4.browserslist 4.29.4 requires
baseline-browser-mapping^2.11.29, so this PR also bumpsbaseline-browser-mappingfrom 2.9.19 to 2.11.32. That is past the 2.11.21 target of bot PR #983, so this PR closes #983 as well.Security
Both packages are transitive, development-only dependencies.
<= 4.28.6, fixed in 4.28.7>= 2.0.0, < 2.11.0, fixed in 2.11.0Lock File Changes
Only
package-lock.jsonchanges, limited to browserslist and its own dependencies:Changes
browserslist 4.28.1 → 4.29.4
SyntaxErrorregression of 4.28.3>and>=queries (fix: exclude joined range when querying above its upper bound browserslist/browserslist#937)including kaiosin baseline queries (fix: support "including kaios" without downstream browserslist/browserslist#939)orparsing performancenot/and notlogic; implementandas opposite ofnotbrowserslist/browserslist#951)nullusage incover X in Yqueries (Do not add versions without usage data to cover queries browserslist/browserslist#952)FIREFOX_ESR_VERSION140 → 153), which changes the result of theFirefox ESRquery and ofdefaults. This does not affect this repository, because babel-loader sets no targets and webpack uses thewebtarget.baseline-browser-mapping 2.9.19 → 2.11.32
engines>=6.0.0; the CLI moved to CommonJS (bindist/cli.js→dist/cli.cjs) (Support Node 6 web-platform-dx/baseline-browser-mapping#121)getTimeline()API and refactored the data compression into a change-list timeline.getCompatibleVersions()andgetAllVersions()now throw anErrorinstead of callingprocess.exit()for unsupported options, which fixes GHSA-w5vr-8v7q-w6rv (feat: add getTimeline() and refactor data compression web-platform-dx/baseline-browser-mapping#137)None of the baseline-browser-mapping changes affect this repository: browserslist 4.29.4 requires
baseline-browser-mapping^2.11.29, and the repository has no baseline queries.Breaking Changes
None
Code Changes Required
None — the upgrade is a drop-in replacement. The parent packages (
@babel/helper-compilation-targets,core-js-compat,webpack) use only stable browserslist APIs, and this repository has no browserslist config.