chore: upgrade baseline-browser-mapping to 2.11.21 to address CVE-2026-45819 - #1645
Merged
Merged
Conversation
Refreshes the yarn.lock entries for baseline-browser-mapping. next requested it at `^2.9.19`, which was stale at 2.10.13; that range already admitted the patched version, so no manifest change or resolution override is needed. The two lock entries now dedupe onto 2.11.21. Addresses CVE-2026-45819. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
Contributor
License Audit
Weak Copyleft Packages (informational)
Resolved Packages (8)
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes SOU-2202
Refreshes the
yarn.lockentries forbaseline-browser-mapping, which now dedupe onto2.11.21.baseline-browser-mappingis not a direct dependency of any workspace. It arrived twice: throughbrowserslistat^2.11.12(already resolving to a patched2.11.20) and throughnextat^2.9.19, which was stale at the affected2.10.13. Both ranges already admitted the patched release, so this is a lockfile refresh only. Nopackage.jsonchange and noresolutionsoverride were needed.Advisory addressed
process.exit()instead of throwing on invalid or conflicting input parameters, allowing immediate process terminationVerification
yarn why baseline-browser-mappingreports every instance resolving tobaseline-browser-mapping@npm:2.11.21, with2.10.13gone from the graph.yarn workspace @sourcebot/web test --run— 140 files, 1440 tests passed.yarn workspace @sourcebot/web build— succeeded. Included because this package feeds browserslist target resolution at build time.🤖 Generated with Claude Code
Note
Low Risk
Lockfile-only transitive dependency bump with no application code changes; risk is limited to browserslist/build-time target resolution behavior in the patched package.
Overview
Addresses CVE-2026-45819 (SOU-2202) by refreshing
yarn.lockso all transitivebaseline-browser-mappinginstances resolve to 2.11.21, removing the stale 2.10.13 copy that came in vianextwhilebrowserslistwas already on a newer patch.There are no
package.jsonor resolution overrides—only lockfile deduplication and a CHANGELOG entry under Unreleased → Fixed.Reviewed by Cursor Bugbot for commit 8d21806. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by cubic
Fixes SOU-2202 by upgrading
baseline-browser-mappingto2.11.21inyarn.lock, addressing CVE-2026-45819. This is a lockfile-only refresh; bothbrowserslistandnextalready permitted the patched version.yarn whyconfirms all instances resolve to2.11.21.Written for commit 8d21806. Summary will update on new commits.