fix(deps): bump the npm_and_yarn group across 17 directories with 13 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: baseline-browser-mapping, js-yaml, fast-uri and qs.
Bumps the npm_and_yarn group with 2 updates in the /examples/symfony/sample directory: baseline-browser-mapping and colord.
Bumps the npm_and_yarn group with 3 updates in the /examples/serverless/vercel-edge directory: next, baseline-browser-mapping and @humanfs/node.
Bumps the npm_and_yarn group with 3 updates in the /examples/reactjs/vite/sample-app directory: baseline-browser-mapping, js-yaml and @humanfs/node.
Bumps the npm_and_yarn group with 3 updates in the /examples/reactjs/ts/sample-app directory: baseline-browser-mapping, js-yaml and colord.
Bumps the npm_and_yarn group with 3 updates in the /examples/reactjs/js/sample-app directory: baseline-browser-mapping, js-yaml and colord.
Bumps the npm_and_yarn group with 3 updates in the /examples/reactjs/hooks/sample-app directory: baseline-browser-mapping, js-yaml and colord.
Bumps the npm_and_yarn group with 3 updates in the /examples/nextjs/ts/sample-app directory: next, baseline-browser-mapping and @humanfs/node.
Bumps the npm_and_yarn group with 3 updates in the /examples/nextjs/page-router/sample-app directory: next, baseline-browser-mapping and @humanfs/node.
Bumps the npm_and_yarn group with 3 updates in the /examples/nextjs/js/sample-app directory: next, baseline-browser-mapping and @humanfs/node.
Bumps the npm_and_yarn group with 3 updates in the /examples/nextjs/hooks/sample-app directory: next, baseline-browser-mapping and @humanfs/node.
Bumps the npm_and_yarn group with 3 updates in the /examples/integrations/Ninetailed/sample-apps/app-using-v3-cdn directory: baseline-browser-mapping, js-yaml and colord.
Bumps the npm_and_yarn group with 3 updates in the /examples/integrations/Ninetailed/sample-apps/app-using-v1.1-cdn directory: baseline-browser-mapping, js-yaml and colord.
Bumps the npm_and_yarn group with 3 updates in the /examples/integrations/Ninetailed/sample-apps/app-using-npm directory: baseline-browser-mapping, js-yaml and colord.
Bumps the npm_and_yarn group with 5 updates in the /examples/gatsby/sample-gatsby-site directory:

Package	From	To
baseline-browser-mapping	2.9.18	2.11.21
js-yaml	3.14.2	3.15.2
colord	2.9.3	2.10.0
joi	17.13.3	17.13.7
multer	2.1.1	2.3.0

Bumps the npm_and_yarn group with 7 updates in the /examples/gatsby/sample-gatsby-plugin-usage directory:

Package	From	To
baseline-browser-mapping	2.9.18	2.11.21
js-yaml	3.14.2	3.15.2
fast-uri	3.1.2	3.1.7
colord	2.9.3	2.10.0
svgo	2.8.2	2.8.4
joi	17.13.3	17.13.7
multer	2.1.1	2.3.0

Bumps the npm_and_yarn group with 5 updates in the /examples/angular/sample-app directory:

Package	From	To
baseline-browser-mapping	2.9.19	2.11.21
js-yaml	4.1.1	4.3.2
fast-uri	3.1.2	3.1.7
immutable	5.1.5	5.1.9
hono	4.12.18	4.13.7

Updates baseline-browser-mapping from 2.10.21 to 2.11.21

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

• 0e5ed80 Patch to 2.11.21 because browser or feature data changed
• 11da0b6 Browser or feature data changed
• 69fcc81 Updating static site
• b964de0 Patch to 2.11.20 because browser or feature data changed
• 723099f Browser or feature data changed
• f44163d Updating static site
• 8966043 Patch to 2.11.19 because browser or feature data changed
• e18601d Browser or feature data changed
• 28cb50a Updating static site
• cb33a83 Patch to 2.11.18 because browser or feature data changed
• Additional commits viewable in compare view

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

Commits

• 5c45bd6 3.15.2 released
• 5a708f9 dist rebuild
• 3485bc0 Backport merge limits from v5.4.1
• f34812f Update .gitignore
• ab85ae2 3.15.1 released
• 30a5e76 dist rebuild
• 22a8071 Backport quadratic complexity fix for !!omap
• c34b6c4 3.15.0 released
• 21e13d3 dist rebuild
• 4165c62 Add v3-legacy tag for publish
• Additional commits viewable in compare view

Updates fast-uri from 3.1.4 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

Commits

• 412e40a Bumped v3.1.7
• 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
• 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
• 6f970b2 Bumped v3.1.6
• d941579 fix: never run IDN canonicalization on bracketed IP literals
• c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
• 37f3417 Merge commit from fork
• 607bfbe Merge commit from fork
• ae92a4c Merge commit from fork
• 444ecda Merge commit from fork
• Additional commits viewable in compare view

Updates qs from 6.15.1 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

• [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
• [Fix] stringify: use configured delimiter after charsetSentinel (#555)
• [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
• [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
• [Fix] parse: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
• [readme] fix grammar (#550)
• [Dev Deps] update @ljharb/eslint-config
• [Tests] add regression tests for keys containing percent-encoded bracket text

Commits

• bb9379e v6.16.0
• 62fd254 [Fix] stringify: serialize Date values when a filter is provided
• 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
• 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
• d56f48c [Fix] parse: flatten a collection appended to an overflowed array
• e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
• 9a76af2 [Dev Deps] update eslint, evalmd
• 3a890d4 [Dev Deps] update eslint, evalmd
• b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
• Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.9.11 to 2.11.21

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

• 0e5ed80 Patch to 2.11.21 because browser or feature data changed
• 11da0b6 Browser or feature data changed
• 69fcc81 Updating static site
• b964de0 Patch to 2.11.20 because browser or feature data changed
• 723099f Browser or feature data changed
• f44163d Updating static site
• 8966043 Patch to 2.11.19 because browser or feature data changed
• e18601d Browser or feature data changed
• 28cb50a Updating static site
• cb33a83 Patch to 2.11.18 because browser or feature data changed
• Additional commits viewable in compare view

Updates colord from 2.9.3 to 2.10.0

Release notes

Sourced from colord's releases.

v2.10 (RGB color mixing)

• mix, tints, shades and tones (mix plugin) now accept an optional interpolation color space. LAB stays the default; pass "rgb" to interpolate RGB channels instead — the way browsers and design tools (such as Figma) composite translucent layers.

import { colord, extend } from "colord";
import mixPlugin from "colord/plugins/mix";
extend([mixPlugin]);
colord("#ff0000").mix("#ffffff", 0.5, "rgb").toHex(); // "#ff8080"
colord("#f0f3f1").mix("#007d40", 0.14, "rgb").toHex(); // "#cee2d8" — same as compositing rgba(0, 125, 64, 0.14) over #f0f3f1
colord("#ff0000").tints(3, "rgb").map((c) => c.toHex()); // ["#ff0000", "#ff8080", "#ffffff"]

Changelog

Sourced from colord's changelog.

2.10.0

• Improve mix plugin by adding an optional "rgb" interpolation mode to mix, tints, tones and shades

2.9.7

• Make HEX parsing and serialization more than 2x faster

2.9.6

• Fix: Rotate the unrounded hue so rotate and harmonies preserve the original color
• Fix: Normalize HWB whiteness + blackness over 100% to gray ❤️ @​spokodev

2.9.5

• Fix: Use adjusted chroma for the CIEDE2000 rotation term ❤️ @​maximilliangrand
• Fix: Keep the hue within [0, 360) in every color model ❤️ @​sarathfrancis90

Both fixes change returned numbers for a small set of colors; toHex() output is unchanged. Snapshots holding h: 360, "hsl(360, …)" or a delta() value may need updating.

2.9.4

• Fix: Reject malformed color strings in linear time ❤️ @​GAP-dev

Commits

• See full diff in compare view

Updates next from 16.2.11 to 16.3.3

Release notes

Sourced from next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in vercel/next.js#97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in vercel/next.js#97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in vercel/next.js#97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in vercel/next.js#97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in vercel/next.js#97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in vercel/next.js#97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in vercel/next.js#97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in vercel/next.js#97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in vercel/next.js#97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @​gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

... (truncated)

Commits

• a9a1cb7 v16.3.3
• 968b9fc [16.3.x] Fix ISR misses with backslashes in segments when deployed on Windows
• 3a15b4a [16.3.x] [next/image]: disable avif image optimization
• 7378b51 Backport/docs fixes 16.3 (#97649)
• 528c1cd [16.3.x] Stop generating error codes (#97780)
• d0ac882 v16.3.2
• 81deb92 [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static ...
• cd714d9 [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• 5ac2327 [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• 0ccb3e7 [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.10.20 to 2.11.21

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

• 0e5ed80 Patch to 2.11.21 because browser or feature data changed
• 11da0b6 Browser or feature data changed
• 69fcc81 Updating static site
• b964de0 Patch to 2.11.20 because browser or feature data changed
• 723099f Browser or feature data changed
• f44163d Updating static site
• 8966043 Patch to 2.11.19 because browser or feature data changed
• e18601d Browser or feature data changed
• 28cb50a Updating static site
• cb33a83 Patch to 2.11.18 because browser or feature data changed
• Additional commits viewable in compare view

Updates sharp from 0.34.5 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

v0.35.4-rc.0

• Upgrade to libvips v8.18.6 for upstream bug fixes.

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

... (truncated)

Commits

• 7f1a0a2 Release v0.35.4
• f927818 Upgrade to sharp-libvips v1.3.3
• e802092 Prerelease v0.35.4-rc.0
• e13eb2f CI: Fix wasm32 build (#4589)
• a82a0b3 Upgrade to libvips v8.18.6
• 8044fe4 Bound resize dimensions to coordinate limit
• 147f859 Docs: changelog entries for #4578 #4584
• ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
• 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
• ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
• Additional commits viewable in compare view

Updates @humanfs/node from 0.16.6 to 0.16.8

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

node: v0.16.7

0.16.7 (2024-11-27)

Bug Fixes

• Add directory to package.json (f691b60)

Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

• Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

0.16.7 (2024-11-27)

Bug Fixes

• Add directory to package.json (f691b60)

Commits

• e96070e chore: release main (#146)
• 22bbaa4 Merge commit from fork
• 956ce7a fix: Include type dependencies at runtime
• 257b7b5 chore: release main (#142)
• f691b60 fix: Add directory to package.json
• 7b81d9a chore(deps): Upgrading retry dependency in node package. (#140)
• See full diff in compare view

Updates baseline-browser-mapping from 2.9.19 to 2.11.21

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

• 0e5ed80 Patch to 2.11.21 because browser or feature data changed
• 11da0b6 Browser or feature data changed
• 69fcc81 Updating static site
• b964de0 Patch to 2.11.20 because browser or feature data changed
• 723099f Browser or feature data changed
• f44163d Updating static site
• 8966043 Patch to 2.11.19 because browser or feature data changed
• e18601d Browser or feature data changed
• 28cb50a Updating static site
• cb33a83 Patch to 2.11.18 because browser or feature data changed
• Additional commits viewable in compare view

Updates js-yaml from 4.3.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

Commits

• 5c45bd6 3.15.2 released
• 5a708f9 dist rebuild
• 3485bc0 Backport merge limits from v5.4.1
• f34812f Update .gitignore
• ab85ae2 3.15.1 released
• 30a5e76 dist rebuild
• 22a8071 Backport quadratic complexity fix for !!omap
• c34b6c4 3.15.0 released
• 21e13d3 dist rebuild
• 4165c62 Add v3-legacy tag for publish
• Additional commits viewable in compare view

Updates @humanfs/node from 0.16.6 to 0.16.8

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

node: v0.16.7

0.16.7 (2024-11-27)

Bug Fixes

• Add directory to package.json (f691b60)

Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

• Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

0.16.7 (2024-11-27)

Bug Fixes

• Add directory to package.json (f691b60)

Commits

• e96070e chore: release main (#146)
• 22bbaa4 Merge commit from fork
• 956ce7a fix: Include type dependencies at runtime
• 257b7b5 chore: release main (#142)
• f691b60 fix: Add directory to package.json
• 7b81d9a chore(deps): Upgrading retry dependency in node package. (#140)
• See full diff in compare view

Updates baseline-browser-mapping from 2.10.20 to 2.11.21

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.jsonDescription has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: dd62b11f-b01e-4d5b-8ccf-68084ffb7d99

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🔵 Needs a closer look

It updates a large set of dependencies across many example projects, so a human should confirm compatibility via CI/test runs for the affected sample apps.

Pull request overview

This PR performs a broad dependency refresh across the repo root and multiple example applications, primarily updating npm lockfiles and a few example package.json files to pick up security and maintenance fixes (e.g., fast-uri security releases, next security releases, and js-yaml hardening).

Changes:

• Bumps several dependencies in the root package-lock.json (notably baseline-browser-mapping, js-yaml v3, fast-uri, qs, and related transitive updates).
• Updates example app lockfiles across Symfony/React/Next.js/Ninetailed/Gatsby/Angular samples to align with the new dependency set (including colord, @humanfs/*, and framework-related transitive updates like sharp for Next.js).
• Updates next to 16.3.3 in several Next.js-based example package.json files.

File summaries

File	Description
package-lock.json	Updates root dependency lock entries for multiple packages (security/maintenance bumps).
examples/symfony/sample/package-lock.json	Refreshes Symfony example lockfile dependency versions.
examples/serverless/vercel-edge/package.json	Bumps next dependency version for the Vercel Edge example.
examples/reactjs/vite/sample-app/package-lock.json	Updates React/Vite example lockfile, including @humanfs/*, baseline-browser-mapping, and js-yaml.
examples/reactjs/ts/sample-app/package-lock.json	Updates React/TS example lockfile for baseline-browser-mapping, colord, fast-uri, and js-yaml v3.
examples/reactjs/js/sample-app/package-lock.json	Updates React/JS example lockfile for baseline-browser-mapping, colord, fast-uri, and js-yaml v3.
examples/reactjs/hooks/sample-app/package-lock.json	Updates React Hooks example lockfile for baseline-browser-mapping, colord, fast-uri, and js-yaml v3.
examples/nextjs/ts/sample-app/package.json	Bumps next dependency version for the Next.js TS example.
examples/nextjs/page-router/sample-app/package.json	Bumps next dependency version for the Next.js Pages Router example.
examples/nextjs/page-router/sample-app/package-lock.json	Updates Pages Router example lockfile for next and related transitive packages.
examples/nextjs/js/sample-app/package.json	Bumps next dependency version for the Next.js JS example.
examples/nextjs/js/sample-app/package-lock.json	Updates Next.js JS example lockfile for next and related transitive packages.
examples/nextjs/hooks/sample-app/package.json	Bumps next dependency version for the Next.js Hooks example.
examples/nextjs/full-stack/sample-app/package-lock.json	Updates full-stack Next.js example lockfile for baseline-browser-mapping.
examples/integrations/Ninetailed/sample-apps/app-using-v3-cdn/package-lock.json	Updates Ninetailed v3 CDN example lockfile for baseline-browser-mapping, colord, fast-uri, and js-yaml v3.
examples/integrations/Ninetailed/sample-apps/app-using-v1.1-cdn/package-lock.json	Updates Ninetailed v1.1 CDN example lockfile for baseline-browser-mapping, colord, fast-uri, and js-yaml v3.
examples/integrations/Ninetailed/sample-apps/app-using-npm/package-lock.json	Updates Ninetailed npm example lockfile for baseline-browser-mapping, colord, fast-uri, and js-yaml v3.
examples/gatsby/sample-gatsby-site/package-lock.json	Updates Gatsby site example lockfile (incl. baseline-browser-mapping, colord, fast-uri, joi, multer, js-yaml v3).
examples/gatsby/sample-gatsby-plugin-usage/package-lock.json	Updates Gatsby plugin example lockfile (incl. svgo, joi, multer, plus other bumps).
examples/angular/sample-app/package-lock.json	Updates Angular example lockfile (incl. js-yaml v4, fast-uri, immutable, hono, baseline-browser-mapping).

Review details

Files not reviewed (17)

• examples/angular/sample-app/package-lock.json: Generated file
• examples/gatsby/sample-gatsby-plugin-usage/package-lock.json: Generated file
• examples/gatsby/sample-gatsby-site/package-lock.json: Generated file
• examples/integrations/Ninetailed/sample-apps/app-using-npm/package-lock.json: Generated file
• examples/integrations/Ninetailed/sample-apps/app-using-v1.1-cdn/package-lock.json: Generated file
• examples/integrations/Ninetailed/sample-apps/app-using-v3-cdn/package-lock.json: Generated file
• examples/nextjs/full-stack/sample-app/package-lock.json: Generated file
• examples/nextjs/hooks/sample-app/package-lock.json: Generated file
• examples/nextjs/js/sample-app/package-lock.json: Generated file
• examples/nextjs/page-router/sample-app/package-lock.json: Generated file
• examples/nextjs/ts/sample-app/package-lock.json: Generated file
• examples/reactjs/hooks/sample-app/package-lock.json: Generated file
• examples/reactjs/js/sample-app/package-lock.json: Generated file
• examples/reactjs/ts/sample-app/package-lock.json: Generated file
• examples/reactjs/vite/sample-app/package-lock.json: Generated file
• examples/serverless/vercel-edge/package-lock.json: Generated file
• examples/symfony/sample/package-lock.json: Generated file

• Files reviewed: 5/23 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

size-limit report 📦

Name	Size	Delta	Limit check
Common - No bundling	5.79 KB	0 B (0% 🟢)	6 KB (✅)
Legacy Utils - No bundling	11.16 KB	0 B (0% 🟢)	12 KB (✅)
Cookies Utils - Legacy - NPM (ESM)	1.54 KB	0 B (0% 🟢)	2 KB (✅)
Cookies Utils - Legacy - NPM (CJS)	1.74 KB	0 B (0% 🟢)	2 KB (✅)
Cookies Utils - Legacy - NPM (UMD)	1.52 KB	0 B (0% 🟢)	2 KB (✅)
Cookies Utils - Modern - NPM (ESM)	1.16 KB	0 B (0% 🟢)	1.5 KB (✅)
Cookies Utils - Modern - NPM (CJS)	1.39 KB	0 B (0% 🟢)	1.5 KB (✅)
Cookies Utils - Modern - NPM (UMD)	1.15 KB	0 B (0% 🟢)	1.5 KB (✅)
Plugins Module Federation Mapping - Legacy - CDN	330 B	0 B (0% 🟢)	512 B (✅)
Plugins Module Federation Mapping - Modern - CDN	330 B	0 B (0% 🟢)	512 B (✅)
Plugins - Legacy - CDN	13.64 KB	0 B (0% 🟢)	15 KB (✅)
Plugins - Modern - CDN	5.52 KB	0 B (0% 🟢)	6 KB (✅)
Core (v1.1) - NPM (ESM)	29.82 KB	0 B (0% 🟢)	32 KB (✅)
Core (v1.1) - NPM (CJS)	30 KB	0 B (0% 🟢)	32 KB (✅)
Core (v1.1) - NPM (UMD)	29.82 KB	0 B (0% 🟢)	32 KB (✅)
Core (Content Script - v1.1) - NPM (ESM)	29.37 KB	0 B (0% 🟢)	30.5 KB (✅)
Core (Content Script - v1.1) - NPM (CJS)	29.55 KB	0 B (0% 🟢)	30.5 KB (✅)
Core (Content Script - v1.1) - NPM (UMD)	29.4 KB	0 B (0% 🟢)	30.5 KB (✅)
Core (v1.1) - Legacy - CDN	31.26 KB	0 B (0% 🟢)	32.5 KB (✅)
Core (v1.1) - Modern - CDN	29.74 KB	0 B (0% 🟢)	32 KB (✅)
Service Worker - Legacy - NPM (ESM)	34.14 KB	0 B (0% 🟢)	34.5 KB (✅)
Service Worker - Legacy - NPM (CJS)	34.34 KB	0 B (0% 🟢)	34.5 KB (✅)
Service Worker - Legacy - NPM (UMD)	34.16 KB	0 B (0% 🟢)	34.5 KB (✅)
Service Worker - Modern - NPM (ESM)	29.93 KB	0 B (0% 🟢)	30.5 KB (✅)
Service Worker - Modern - NPM (CJS)	30.15 KB	0 B (0% 🟢)	30.5 KB (✅)
Service Worker - Modern - NPM (UMD)	29.95 KB	0 B (0% 🟢)	30 KB (✅)
All Integrations - Legacy - CDN	100.5 KB	0 B (0% 🟢)	102 KB (✅)
All Integrations - Modern - CDN	92.9 KB	0 B (0% 🟢)	94.5 KB (✅)
SDK Loader	816 B	0 B (0% 🟢)	1 KB (✅)
SDK Loader (GTM)	774 B	0 B (0% 🟢)	1 KB (✅)
Core - Legacy - NPM (ESM)	49.13 KB	0 B (0% 🟢)	50 KB (✅)
Core - Legacy - NPM (CJS)	49.35 KB	0 B (0% 🟢)	50 KB (✅)
Core - Legacy - NPM (UMD)	49.16 KB	0 B (0% 🟢)	50 KB (✅)
Core - Legacy - CDN	49.24 KB	0 B (0% 🟢)	50 KB (✅)
Core - Modern - NPM (ESM)	28.35 KB	0 B (0% 🟢)	28.5 KB (✅)
Core - Modern - NPM (CJS)	28.58 KB	0 B (0% 🟢)	29 KB (✅)
Core - Modern - NPM (UMD)	28.39 KB	0 B (0% 🟢)	28.5 KB (✅)
Core - Modern - CDN	28.64 KB	0 B (0% 🟢)	29 KB (✅)
Core (Bundled) - Legacy - NPM (ESM)	49.16 KB	0 B (0% 🟢)	50 KB (✅)
Core (Bundled) - Legacy - NPM (CJS)	49.43 KB	0 B (0% 🟢)	50 KB (✅)
Core (Bundled) - Legacy - NPM (UMD)	49.18 KB	0 B (0% 🟢)	50 KB (✅)
Core (Bundled) - Modern - NPM (ESM)	41.56 KB	0 B (0% 🟢)	42 KB (✅)
Core (Bundled) - Modern - NPM (CJS)	41.88 KB	0 B (0% 🟢)	42 KB (✅)
Core (Bundled) - Modern - NPM (UMD)	41.65 KB	0 B (0% 🟢)	42 KB (✅)
Core (Content Script) - Legacy - NPM (ESM)	49.11 KB	0 B (0% 🟢)	50 KB (✅)
Core (Content Script) - Legacy - NPM (CJS)	49.26 KB	0 B (0% 🟢)	50 KB (✅)
Core (Content Script) - Legacy - NPM (UMD)	49.08 KB	0 B (0% 🟢)	50 KB (✅)
Core (Content Script) - Modern - NPM (ESM)	41.5 KB	0 B (0% 🟢)	42 KB (✅)
Core (Content Script) - Modern - NPM (CJS)	41.75 KB	0 B (0% 🟢)	42.5 KB (✅)
Core (Content Script) - Modern - NPM (UMD)	41.55 KB	0 B (0% 🟢)	42 KB (✅)
Core (Lite) - Legacy - NPM (ESM)	37.9 KB	0 B (0% 🟢)	39 KB (✅)
Core (Lite) - Legacy - NPM (CJS)	38.06 KB	0 B (0% 🟢)	39 KB (✅)
Core (Lite) - Legacy - NPM (UMD)	37.89 KB	0 B (0% 🟢)	39 KB (✅)
Core (Lite) - Modern - NPM (ESM)	33.08 KB	0 B (0% 🟢)	34 KB (✅)
Core (Lite) - Modern - NPM (CJS)	33.32 KB	0 B (0% 🟢)	34 KB (✅)
Core (Lite) - Modern - NPM (UMD)	33.09 KB	0 B (0% 🟢)	34 KB (✅)