Bump the npm-dependencies-security group across 6 directories with 16 updates

[dependabot]

Bumps the npm-dependencies-security group with 9 updates in the /@plotly/dash-generator-test-component-nested directory:

Package	From	To
@babel/core	7.19.6	7.29.7
webpack	5.99.6	5.111.1
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
@babel/core	7.19.6	7.29.7
webpack	5.99.6	5.111.1
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
webpack	5.99.6	5.111.1
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
@babel/core	7.19.6	7.29.7
webpack	5.99.6	5.111.1
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5

Bumps the npm-dependencies-security group with 9 updates in the /@plotly/dash-generator-test-component-standard directory:

Package	From	To
@babel/core	7.19.6	7.29.7
webpack	5.99.6	5.111.1
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
@babel/core	7.19.6	7.29.7
webpack	5.99.6	5.111.1
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
webpack	5.99.6	5.111.1
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
@babel/core	7.19.6	7.29.7
webpack	5.99.6	5.111.1
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5

Bumps the npm-dependencies-security group with 10 updates in the /@plotly/dash-generator-test-component-typescript directory:

Package	From	To
@babel/core	7.18.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.28.1	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
@babel/core	7.18.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.28.1	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
@babel/core	7.18.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
baseline-browser-mapping	2.9.19	2.11.27
brace-expansion	1.1.11	1.1.21
browserslist	4.28.1	4.29.3
js-yaml	3.14.2	3.15.2
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
@babel/core	7.18.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.28.1	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
js-yaml	3.14.2	3.15.2
minimatch	3.1.2	3.1.5

Bumps the npm-dependencies-security group with 7 updates in the /@plotly/dash-jupyterlab directory:

Package	From	To
ajv	8.17.1	8.20.0
brace-expansion	1.1.11	1.1.21
minimatch	3.0.4	3.1.5
ajv	8.17.1	8.20.0
brace-expansion	1.1.11	1.1.21
minimatch	3.0.4	3.1.5
ajv	8.17.1	8.20.0
brace-expansion	1.1.11	1.1.21
minimatch	3.0.4	3.1.5
ajv	8.17.1	8.20.0
brace-expansion	1.1.11	1.1.21
lodash	4.17.23	4.18.1
minimatch	3.0.4	3.1.5
nanoid	3.3.7	3.3.20
postcss	8.4.47	8.5.29
ws	8.18.0	8.22.0
ajv	8.17.1	8.20.0
brace-expansion	1.1.11	1.1.21
minimatch	3.0.4	3.1.5
ajv	8.17.1	8.20.0
brace-expansion	1.1.11	1.1.21
minimatch	3.0.4	3.1.5

Bumps the npm-dependencies-security group with 9 updates in the /@plotly/dash-test-components directory:

Package	From	To
@babel/core	7.19.6	7.29.7
webpack	5.99.6	5.111.1
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
@babel/core	7.19.6	7.29.7
webpack	5.99.6	5.111.1
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
webpack	5.99.6	5.111.1
@babel/core	7.19.6	7.29.7
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
@babel/core	7.19.6	7.29.7
webpack	5.99.6	5.111.1
@babel/plugin-transform-modules-systemjs	7.19.6	7.29.8
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
browserslist	4.24.4	4.29.3
minimatch	3.1.2	3.1.5
picomatch	2.3.1	2.3.2
shell-quote	1.7.3	1.12.0
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5

Bumps the npm-dependencies-security group with 5 updates in the /@plotly/eslint-config-dash directory:

Package	From	To
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
js-yaml	4.1.0	4.3.2
minimatch	3.1.2	3.1.5
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
minimatch	3.1.2	3.1.5
ajv	6.12.6	6.15.0
brace-expansion	1.1.11	1.1.21
flatted	3.2.4	3.4.4
js-yaml	4.1.0	4.3.2
minimatch	3.1.2	3.1.5

Updates @babel/core from 7.19.6 to 7.29.7

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser

... (truncated)

Commits

• 4fba754 v7.29.7
• 04ea6b2 v7.29.6
• 99f498a [7.x packport]Improve input source map handling (#18001)
• feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
• aa8394e v7.29.0
• ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
• d7f4008 v7.28.6
• e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
• 99dcba5 chore: enable some ts-eslint rules (#17592)
• c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/core since your current version.

Updates webpack from 5.99.6 to 5.111.1

Release notes

Sourced from webpack's releases.

v5.111.1

Patch Changes

• Throw on a write to an imported binding without losing concatenation. (by @​alexander-akait in #22141)

• Keep the </html> a page was written with, whatever opened the element. (by @​aryanraj45 in #22103)

• Look an attribute up by what its value decodes to, not how it was spelled. (by @​aryanraj45 in #22107)

• Minify HTML by what a value says rather than how it was spelled. (by @​alexander-akait in #22154)

• Follow HTML template form and frameset rules during tree construction. (by @​dependabot in #22129)

• Keep the whitespace calc() needs around + and - in a custom property. (by @​alexander-akait in #22150)

• Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @​alexander-akait in #22119)

• Rewrite an attribute value the source spelled with character references. (by @​aryanraj45 in #22110)

• Unquote an HTML attribute value carrying a vertical tab. (by @​alexander-akait in #22162)

• Keep a shadow's spread and canonicalize a merged selector list. (by @​alexander-akait in #22101)

• Leave out an implied tag and merge adjacent runs on the first pass. (by @​aryanraj45 in #22121)

• Minify in one pass what a second pass of the CSS minifier used to find. (by @​alexander-akait in #22106)

• Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @​aryanraj45 in #22126)

• Keep initial where an engine reads the property's initial keyword apart. (by @​aryanraj45 in #22128)

• Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @​alexander-akait in #22108)

• Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @​alexander-akait in #22111)

• Run the printer equivalence suite against Firefox as well as Chrome. (by @​aryanraj45 in #22151)

• Finish in one CSS pass the joins, drops and collapses left to a second. (by @​alexander-akait in #22117)

• Move the context module sources into lib/context/. (by @​alexander-akait in #22115)

• Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @​alexander-akait in #22116)

• Emit a failing module's stack relative, and name what a tap failed with. (by @​alexander-akait in #22122)

• Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @​alexander-akait in #22120)

• Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @​alexander-akait in #22142)

• Record hoisted, module and block declarations while parsing, not by re-walking. (by @​alexander-akait in #22147)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.111.1

Patch Changes

• Throw on a write to an imported binding without losing concatenation. (by @​alexander-akait in #22141)

• Keep the </html> a page was written with, whatever opened the element. (by @​aryanraj45 in #22103)

• Look an attribute up by what its value decodes to, not how it was spelled. (by @​aryanraj45 in #22107)

• Minify HTML by what a value says rather than how it was spelled. (by @​alexander-akait in #22154)

• Follow HTML template form and frameset rules during tree construction. (by @​dependabot in #22129)

• Keep the whitespace calc() needs around + and - in a custom property. (by @​alexander-akait in #22150)

• Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @​alexander-akait in #22119)

• Rewrite an attribute value the source spelled with character references. (by @​aryanraj45 in #22110)

• Unquote an HTML attribute value carrying a vertical tab. (by @​alexander-akait in #22162)

• Keep a shadow's spread and canonicalize a merged selector list. (by @​alexander-akait in #22101)

• Leave out an implied tag and merge adjacent runs on the first pass. (by @​aryanraj45 in #22121)

• Minify in one pass what a second pass of the CSS minifier used to find. (by @​alexander-akait in #22106)

• Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @​aryanraj45 in #22126)

• Keep initial where an engine reads the property's initial keyword apart. (by @​aryanraj45 in #22128)

• Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @​alexander-akait in #22108)

• Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @​alexander-akait in #22111)

• Run the printer equivalence suite against Firefox as well as Chrome. (by @​aryanraj45 in #22151)

• Finish in one CSS pass the joins, drops and collapses left to a second. (by @​alexander-akait in #22117)

• Move the context module sources into lib/context/. (by @​alexander-akait in #22115)

• Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @​alexander-akait in #22116)

• Emit a failing module's stack relative, and name what a tap failed with. (by @​alexander-akait in #22122)

• Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @​alexander-akait in #22120)

• Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @​alexander-akait in #22142)

... (truncated)

Commits

• 5a10675 chore(release): new release (#22105)
• 9c448c4 test: consolidate loose harness files under test/harness (#22163)
• a947604 fix(html): unquote an attribute value carrying a vertical tab (#22162)
• db556f3 test: run the printer equivalence suite against Gecko in CI (#22155)
• d174cdf perf(css): drop a fallback every browserslist target reads past (#22158)
• 39f14f2 refactor(javascript): declare block bindings from the parse (#22161)
• 0835411 test: move suite drivers into test/templates (#22159)
• b48cd77 fix(html): minify by what a value says rather than how it was spelled (#22154)
• a774f10 test: define the webpack major instead of bundling package.json (#22160)
• 4b2eed0 docs: report only what needs a decision while watching a PR (#22156)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.

Updates @babel/plugin-transform-modules-systemjs from 7.19.6 to 7.29.8

Release notes

Sourced from @​babel/plugin-transform-modules-systemjs's releases.

v7.29.8 (2026-07-31)

👓 Spec Compliance

• babel-generator, babel-parser, babel-plugin-transform-spread, babel-traverse, babel-types
  • #17871 Disallow super call after new (@​JLHwung)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-node, babel-plugin-transform-modules-systemjs
  • #18044 fix(systemjs): support __proto__ as an export name (@​JLHwung)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

... (truncated)

Commits

• 5de11ca v7.29.8
• f08d434 fix(systemjs): support proto as an export name (#18044)
• 4fba754 v7.29.7
• a458f66 v7.29.4
• 32ebd5a [7.x backport]fix(systemjs): improve module string name support (#17974)
• aa8394e v7.29.0
• 0053db6 Update polyfill packages (#17727)
• 61647ae v7.28.5
• a177d55 [Babel 8] Use t.traverseFast to replace some path.traverse (#17518)
• eebd3a0 v7.27.1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/plugin-transform-modules-systemjs since your current version.

Updates ajv from 6.12.6 to 6.15.0

Commits

• 184bc32 6.15.0
• fea46af test/fix prototype pollution via $data ref with format keyword (#2606)
• e3af0a7 6.14.0
• b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
• 72f2286 docs: update v7 info
• 231e52b Merge pull request #1320 from philsturgeon/patch-1
• d3475fc Add spectral, an AJV util from a sponsor
• 413afe0 docs: v7.0.0-beta.3
• 11e997b update readme for v7
• See full diff in compare view

Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

Updates browserslist from 4.24.4 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

4.28.1

• Removed Baseline warning since we have it own warning.

4.27.0

• Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

• Fixed throwOnMissing with extends query (by @​alexander-akait).

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improved or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

... (truncated)

Commits

• b4809dd Release 4.29.3 version
• 9d844f8 Update Firefox ESR
• 0033f34 Update dependencies
• 906d329 Release 4.29.2 version
• ff8c83f Update dependencies
• 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
• f760921 Do not add versions without usage data to cover queries
• 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
• 1e5356f Note that Android version queries return only the latest version
• 5b7e941 Add missed changes to ChangeLog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

• Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

• Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
• Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).

Commits

• 81cba8d Publish 2.3.2
• fc1f6b6 Merge commit from fork
• eec17ae Merge commit from fork
• 78f8ca4 Merge pull request #156 from micromatch/backport-144
• 3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
• See full diff in compare view

Updates shell-quote from 1.7.3 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

• [New] parse: support here-documents (<<) [#31](https://github.com/ljharb/shell-quote/issues/31)

Com...

Description has been truncated

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dash performance benchmarks

❌ perf regression

	scenario	metric	p90 (ms)	median	growth	baseline p90	note
❌	full_children_replace	replace_ms	9526.0	2029.2	30.88x	4697.1	p90 9526.0ms > warn 6000ms; 2.1x baseline (norm)
✅	callback_chain	chain_ms	592.7	530.2	0.85x	499.1
✅	callback_chain	graph_ms	2.4	2.4	1.0x	2.4
✅	callback_fanout	fanout_ms	87.7	84.5	0.94x	92.5
✅	deep_nesting	render_ms	61.2	57.8	0.95x	56.8
✅	initial_render_large	render_ms	698.5	634.2	1.29x	694.4
✅	initial_render_small	render_ms	109.6	94.5	1.05x	104.0
✅	patch_append_nested	append_ms	157.1	109.0	2.52x	192.3
✅	patch_append_toplevel	append_ms	140.6	97.1	2.29x	140.2
✅	patch_scalar_update_large	update_ms	172.4	164.9	0.95x	202.9
✅	wildcard_all_resolve	wildcard_ms	319.6	309.5	0.95x	313.6
✅	wildcard_all_resolve	graph_ms	1.4	1.4	1.0x	1.3

growth = late-third / early-third per-op time; ~1 is flat, a large value means the per-op cost scales with accumulated state.

machine scale vs baseline: 0.98x - divided out of the baseline ratios so they compare like for like (the absolute warn/fail ceilings are left un-scaled); calibrated on initial_render_small.