fix(deps): update dependency baseline-browser-mapping to v2.11.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
baseline-browser-mapping	2.10.43 → 2.11.0

---

baseline-browser-mapping process termination on invalid input causes denial of service

CVE-2026-45819 / GHSA-w5vr-8v7q-w6rv

More information

Details

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-45819
• https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519
• https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142
• https://www.npmjs.com/package/baseline-browser-mapping
• https://github.com/web-platform-dx/baseline-browser-mapping/pull/137
• https://github.com/web-platform-dx/baseline-browser-mapping/commit/de733e2d8959559f7bb255d5927f3afcb6f31589
• https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0
• https://github.com/advisories/GHSA-w5vr-8v7q-w6rv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.11.0

Compare Source

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #​134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.44

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @material-ui/[email protected]
npm error Found: [email protected]
npm error node_modules/react
npm error   react@"17.0.2" from the root project
npm error   peer react@"17.0.2" from @hot-loader/[email protected]
npm error   node_modules/@hot-loader/react-dom
npm error     dev @hot-loader/react-dom@"17.0.2" from the root project
npm error   11 more (@testing-library/react, gatsby, gatsby-link, ...)
npm error
npm error Could not resolve dependency:
npm error peer react@"^16.8.0" from @material-ui/[email protected]
npm error node_modules/@material-ui/core
npm error   @material-ui/core@"4.9.14" from the root project
npm error   peer @material-ui/core@"^4.0.0" from @material-ui/[email protected]
npm error   node_modules/@material-ui/icons
npm error     @material-ui/icons@"4.9.1" from the root project
npm error   1 more (@material-ui/lab)
npm error
npm error Conflicting peer dependency: [email protected]
npm error node_modules/react
npm error   peer react@"^16.8.0" from @material-ui/[email protected]
npm error   node_modules/@material-ui/core
npm error     @material-ui/core@"4.9.14" from the root project
npm error     peer @material-ui/core@"^4.0.0" from @material-ui/[email protected]
npm error     node_modules/@material-ui/icons
npm error       @material-ui/icons@"4.9.1" from the root project
npm error     1 more (@material-ui/lab)
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-11T02_12_12_696Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-11T02_12_12_696Z-debug-0.log