Skip to content

build(deps): bump browserslist from 4.28.1 to 4.28.8 in /docs - #349

Merged
glennko merged 2 commits into
mainfrom
dependabot/npm_and_yarn/docs/browserslist-4.28.8
Sep 3, 2026
Merged

build(deps): bump browserslist from 4.28.1 to 4.28.8 in /docs#349
glennko merged 2 commits into
mainfrom
dependabot/npm_and_yarn/docs/browserslist-4.28.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps browserslist from 4.28.1 to 4.28.8.

Release notes

Sourced from browserslist's releases.

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

Changelog

Sourced from browserslist's changelog.

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

Commits
  • f2f2e6c Release 4.28.8 version
  • d0787c8 Update dependencies
  • fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
  • 57ecd64 fix: support "including kaios" without downstream
  • 093a0f6 Update EM banner
  • b637868 Release 4.28.7 version
  • 313f465 Update dependencies
  • c935c5a Fix regexp performance
  • d7e9e65 Rewrite structure parsing to make it always fast
  • ec4a55e Fix import order
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/docs/browserslist-4.28.8 branch 2 times, most recently from d124a96 to 58da6c9 Compare September 3, 2026 02:54
@dependabot dependabot Bot changed the title build(deps): bump browserslist from 4.27.0 to 4.28.8 in /docs build(deps): bump browserslist from 4.28.1 to 4.28.8 in /docs Sep 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/docs/browserslist-4.28.8 branch 2 times, most recently from 6d24ff6 to ce33f07 Compare September 3, 2026 03:03
@dependabot
build(deps): bump browserslist from 4.28.1 to 4.28.8 in /docs
942df23 
Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.1 to 4.28.8.
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.28.8)

---
updated-dependencies:
- dependency-name: browserslist
  dependency-version: 4.28.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/docs/browserslist-4.28.8 branch from ce33f07 to 942df23 Compare September 3, 2026 03:05
glennko
glennko approved these changes Sep 3, 2026
View reviewed changes

@glennko glennko left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lockfile-only dependency bump; CI green.

@glennko
glennko merged commit 3453f50 into main Sep 3, 2026
4 checks passed
@glennko
glennko deleted the dependabot/npm_and_yarn/docs/browserslist-4.28.8 branch September 3, 2026 03:09
glennko added a commit that referenced this pull request Sep 3, 2026
@glennko
chore(docs-deps): refresh lockfile to clear both critical advisories
482f23f 
Single `npm audit fix --package-lock-only` pass on the docs site.
package.json is untouched -- no declared range changes, only the
resolved tree.

Regenerated against current main, which now carries the merged
dependabot bumps (#347, #346, #332, #326, #314, #352, #351, #349,
#348). Those bumps did not reach either critical, and dependabot
never proposed a fix for websocket-driver at all.

           before  after
critical        2      0
high           27     18
moderate       14      8
low             5      0
total          48     26

Both criticals cleared:
- shell-quote     1.8.3 -> 1.10.0  (CVE-2026-9277)
- websocket-driver 0.7.4 -> 0.7.5  (CVE-2026-54466)

Also lodash 4.17.23 -> 4.18.1 and node-forge dropped from the tree.

The remaining 26 sit inside the Docusaurus dependency tree --
image-size, serialize-javascript, and the webpack-dev-server ->
sockjs -> uuid chain. Most report no non-breaking fix and would need
a Docusaurus major upgrade. The dev-server chain affects
`docusaurus start`, not `docusaurus build`.

`npm audit fix --force` was deliberately not used -- it would churn
the Docusaurus major version and risk the docs build, for issues that
are dev-time only.
glennko added a commit that referenced this pull request Sep 3, 2026
@glennko
chore(docs-deps): refresh lockfile to clear both critical advisories (#…
2173e28 
…342)

Single `npm audit fix --package-lock-only` pass on the docs site.
package.json is untouched -- no declared range changes, only the
resolved tree.

Regenerated against current main, which now carries the merged
dependabot bumps (#347, #346, #332, #326, #314, #352, #351, #349,
#348). Those bumps did not reach either critical, and dependabot
never proposed a fix for websocket-driver at all.

           before  after
critical        2      0
high           27     18
moderate       14      8
low             5      0
total          48     26

Both criticals cleared:
- shell-quote     1.8.3 -> 1.10.0  (CVE-2026-9277)
- websocket-driver 0.7.4 -> 0.7.5  (CVE-2026-54466)

Also lodash 4.17.23 -> 4.18.1 and node-forge dropped from the tree.

The remaining 26 sit inside the Docusaurus dependency tree --
image-size, serialize-javascript, and the webpack-dev-server ->
sockjs -> uuid chain. Most report no non-breaking fix and would need
a Docusaurus major upgrade. The dev-server chain affects
`docusaurus start`, not `docusaurus build`.

`npm audit fix --force` was deliberately not used -- it would churn
the Docusaurus major version and risk the docs build, for issues that
are dev-time only.

Co-authored-by: Glenn Ko <glennko@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@glennko glennko glennko approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@glennko