refactor: Bump browserslist from 4.28.1 to 4.29.0

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #3447

Approach

Bumps the transitive dev dependency browserslist from 4.28.1 to 4.29.0. The change is limited to the lock file. It updates the single browserslist copy used by webpack, @babel/helper-compilation-targets and core-js-compat, along with its own dependencies (baseline-browser-mapping 2.11.25, caniuse-lite 1.0.30001810, electron-to-chromium 1.5.438, node-releases 2.0.57, update-browserslist-db 1.3.3). This resolves the security advisory GHSA-73wf-gq98-2v4g (fixed in 4.28.7). The updated baseline-browser-mapping also resolves GHSA-w5vr-8v7q-w6rv. The dependency is development-only.

4.29.0 is the latest in-range release and supersedes the 4.28.8 target of the Dependabot PR.

Changes

• 4.28.2: Fixed prototype pollution
• 4.28.3: Fixed baseline query case-insensitivity
• 4.28.4: Fixed a SyntaxError regression of 4.28.3
• 4.28.5: Fixed > and >= queries
• 4.28.6: Fixed Electron version queries
• 4.28.7: Improved parsing performance, fixed unbounded memory growth, fixed a prototype write issue
• 4.28.8: Fixed including kaios in baseline queries
• 4.28.9: Improved or parsing performance
• 4.29.0: Added query continuations across lines and array entries

Breaking Changes

None

Code Changes Required

None. This is a drop-in replacement. The consuming packages only use the browserslist() query and config-loading APIs, which are unchanged, and this repository has no browserslist configuration.

Tasks

N/A. This is a lock-file-only dependency update.

Summary by CodeRabbit

• Chores
  • Updated browser compatibility data and related tooling versions. These updates affect the information used by development and build tools; no changes to user-facing features or behavior are noted.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: ff79e0e0-4dbe-49cc-85aa-7faac8dc4bcd

📥 Commits

Reviewing files that changed from the base of the PR and between 2ee7843 and 1f628d7.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The lockfile updates Browserslist and five related packages. It also changes the baseline-browser-mapping executable path and adds a Node.js >=18 engine declaration for node-releases.

Changes

Browser data dependency updates

Layer / File(s)	Summary
Browserslist and browser-data package updates package-lock.json	The lockfile records newer versions of Browserslist and related browser-data packages, raised dependency requirements, an updated executable path, and a Node.js engine declaration for node-releases.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 1f628

No actionable issue is identified in this dependency update; it appears ready to merge after normal checks.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Engage In Review Feedback	❓ Inconclusive	The current review has zero actionable findings, so no current-review feedback requires engagement. However, the supplied review data explicitly does not establish whether earlier posted review commen…	Provide the complete review-comment history and discussion states. Confirm that each earlier feedback comment was either addressed by a commit or followed by discussion that convinced the reviewer to retract it.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the allowed refactor: prefix and starts the subject with a capitalized letter. It accurately describes the dependency update.
Description check	✅ Passed	The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the dependency update, security fixes, scope, and testing impact.
Linked Issues check	✅ Passed	Issue [#3447] requires upgrading the development dependency browserslist from 4.28.1 to 4.29.0. The PR summary identifies the browserslist lockfile update and the corresponding dependency requirem…
Out of Scope Changes check	✅ Passed	The PR changes only package-lock.json. The listed updates to baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, and update-browserslist-db, including registry met…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check	✅ Passed	PASS. The PR changes only package-lock.json. It upgrades six development-only packages, all from registry.npmjs.org with integrity hashes and no install scripts. npm audit reports no advisories for an…

Full details: Engage In Review Feedback

Explanation

The current review has zero actionable findings, so no current-review feedback requires engagement. However, the supplied review data explicitly does not establish whether earlier posted review comments exist or were resolved. Repository inspection found no usable review-discussion metadata. The required evidence for engagement with all feedback comments is unavailable.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[parseplatformorg]

🎉 This change has been released in version 9.3.0-alpha.6