Repository navigation
refactor: Bump browserslist from 4.23.2 to 4.29.4 - #951
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update browser data dependency locks package-lock.json |
The lockfile adds baseline-browser-mapping and updates the locked versions and dependency ranges for browserslist, caniuse-lite, electron-to-chromium, escalade, node-releases, and update-browserslist-db. It records the updates in both dependency sections. |
Priority:
Estimated code review effort: 2 (Simple) | ~8 minutes
Merge Risk: 
5abfb
-
No concrete merge-blocking risk remains.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title begins with the allowed prefix "refactor:" and uses a capitalized first word. It accurately describes the browserslist dependency update in the lockfile. Linked Issues check Direct issue [ #939] requires upgradingbrowserslistfrom 4.23.2 to 4.28.9. The whole-PR diff updatespackage-lock.jsontobrowserslist4.29.4 and includes the required 4.28.7 security fixes. The…Out of Scope Changes check The whole-PR diff changes only package-lock.json. The addedbaseline-browser-mappingentry and updates tocaniuse-lite,electron-to-chromium,node-releases,update-browserslist-db, `escala…Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Security Check PASS: The pull request changes only package-lock.json; it introduces no executable application code or security-sensitive patterns. The lockfile upgradesbrowserslistfrom 4.23.2 to 4.29.4 and kee…Engage In Review Feedback No review feedback required engagement. The supplied review context reports no CodeRabbit review threads and zero actionable findings in the current review. Full details: Linked Issues check
-
Explanation
Direct issue [
#939] requires upgradingbrowserslistfrom 4.23.2 to 4.28.9. The whole-PR diff updatespackage-lock.jsontobrowserslist4.29.4 and includes the required 4.28.7 security fixes. The related dependency updates support this lockfile resolution. No source-code or test changes are required by the issue.
Full details: Out of Scope Changes check
-
Explanation
The whole-PR diff changes only
package-lock.json. The addedbaseline-browser-mappingentry and updates tocaniuse-lite,electron-to-chromium,node-releases,update-browserslist-db,escalade, andpicocolorssupport thebrowserslistdependency update. No unrelated implementation or test changes are present.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Full details: Security Check
-
Explanation
PASS: The pull request changes only
package-lock.json; it introduces no executable application code or security-sensitive patterns. The lockfile upgradesbrowserslistfrom 4.23.2 to 4.29.4 and keeps it markeddev: true, together with its related development dependencies. The repository manifest shows the package is reached through thenyccoverage development tool, while production dependencies remain unchanged. The updated version is above the supplied advisory fixed version 4.28.7.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
🎉 This change has been released in version 3.1.0 |
Closes #939
Bumps the transitive dev dependency
browserslistfrom 4.23.2 to 4.29.4. This fixes two high-severity advisories. Onlypackage-lock.jsonchanges.Security
browserslist-stats.jsoncustom stats (normalizeStats)<= 4.28.6<= 4.28.6browserslistis a development-only dependency.npm ls browserslist --omit=devreturns nothing. The only path isnyc→istanbul-lib-instrument→@babel/core→@babel/helper-compilation-targets→browserslist.Version
Dependabot targeted 4.28.9.
npm update browserslistresolves 4.29.4, the currentlatest, within the^4.23.1range of@babel/helper-compilation-targets. 4.29.0 to 4.29.4 were released after Dependabot opened #939, so this PR uses 4.29.4 and the changelog below covers every version up to it.Lock file changes
browserslistbaseline-browser-mappingbrowserslistsince 4.26.0)caniuse-liteelectron-to-chromiumnode-releasesupdate-browserslist-dbescaladeAll of these are dependencies of
browserslist.escaladecomes in throughupdate-browserslist-db1.3.4, which requires^3.2.0. No entry is removed, andlockfileVersionstays 2.escaladeis shared with severalyargscopies (^3.1.1). Two of them matter here:yargs17.7.3 on the optional production pathparse-server→@parse/push-adapter→firebase-admin→@google-cloud/firestore→google-gax→@grpc/grpc-js/@grpc/proto-loader.yargs18.0.0 undermongodb-runner, which CI runs inpretest/posttest.3.2.0 changes only TypeScript declarations: it adds
.d.mtsfiles and neststypesunder theimport/requireconditions inexports. The runtime files (dist/index.js,dist/index.mjs,sync/index.js,sync/index.mjs) are byte-identical to 3.1.2.yargsusesescalade/syncto findpackage.jsonupwards, and that lookup behaves the same.The lock was regenerated on the current
masterwith npm 10.9.3. Dependabot's lock on refactor: Bump browserslist from 4.23.2 to 4.28.9 #939 was built on an oldermasterand drops the optional entriessocks,smart-bufferandgcp-metadata(with nestedgaxiosandnode-fetch). This lock keeps them, as fix: Bump ip-address from 10.1.0 to 10.7.4 and parse-server from 9.10.0 to 9.10.7 #946, refactor: Bump undici from 6.27.0 to 6.29.1 and 7.28.0 to 7.30.1 #947 and refactor: Bump js-yaml from 3.14.2 to 3.15.2 and 4.1.1 to 4.3.2 #950 did.Impact on this project
.babelrc,babel.config.*,.browserslistrcorbrowserslistfile, and nobrowserslistkey inpackage.json.tsxand Jasmine, withmongodb-runnerinpretest/posttest.nycis used only by the localcoveragescript.npm run coverageruns,istanbul-lib-instrumentcalls@babel/corewithconfigFile: false,babelrc: falseand notargets.@babel/helper-compilation-targetstherefore only callsbrowserslist.loadConfig(). That finds no config, so no query is resolved and the targets are empty on both versions. Browserslist's outdated-data warning only fires when a query is resolved, so it does not appear either.update-browserslist-dbis a CLI (npx update-browserslist-db). Onlybrowserslist's own CLI (cli.js) requires it. That CLI loads it on every run but calls it only for the deprecated--update-dbflag. Thebrowserslistlibrary entry point does not load it, and nothing in this repository runs either CLI.browserslistnow loadsbaseline-browser-mappingalong with itself. At load time, that package only defines its data and functions. Its functions, and their outdated-data warning, run only for Baseline queries, which this repository does not use.Changes
browserslist
>=query forios.browserslist.findConfigFile()helper.caniuse-liteupdate to the warning. The warning threshold also changed. It used to fire when the latest browser release in the data was more than 6 × 30 days old. It now fires when that release is 6 or more calendar months old (getMonthsPassed).caniuse-litewarning text.package.jsonfile is now JSON-parsed only if its text contains"browserslist"(or the misspelled"browserlist"). Before, everypackage.jsonon the way up was parsed, and an unparsable one logged[Browserslist] Could not parse <file>. Ignoring it.cover 95% in browserslist-config-mycompany statsquery support.--permissionsupport.baseline-browser-mappingdependency.baseline-browser-mappingversion requirement.throwOnMissingwithextendsquery.BROWSERSLIST_TRACE_WARNINGenvironment variable.firefox >= esrquery support. Docs fixes. (The upstream changelog heading for this release reads "4.48.0".)baseline-browser-mappinghas its own.SyntaxErrorregression of 4.28.3.>and>=queries.including kaiosin Baseline queries.orparsing performance.supportsqueries. Fixed old Node.js tests. Reduced code.nullusage incover X in Yquery.firefox esr, which is also part ofdefaults, from Firefox 115 and 128 to Firefox 153.update-browserslist-db (CLI only)
package.jsonchanges onpnpmupdate.baseline-browser-mapping).ERR_PNPM_NO_PACKAGE_IN_DEPENDENCIESerror on pnpm.depthin pnpm config.--versionoutput, npm version detection, Bun support, Deno support on new Deno versions, the error message on a missing package manager, and pnpm 12 support.pnpmminimumReleaseAgecompatibility.pnpmminimumReleaseAgecompatibility issue. Fixed Windows support.escalade
Data packages:
caniuse-lite,electron-to-chromiumandnode-releasescontain browser, Electron and Node.js release data only.node-releases2.0.60 declaresengines.node>=18. Every moved package'senginesis compatible with this project'sengines.nodeand with Node 22 in CI.Breaking Changes
None
Code Changes Required
None. The upgrade is a drop-in replacement.
Summary by CodeRabbit