chore(deps): bump baseline-browser-mapping from 2.10.38 to 2.11.22 in /lua-discord-moderator/agent

[dependabot]

Bumps baseline-browser-mapping from 2.10.38 to 2.11.22.

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

• af7c3c4 Patch to 2.11.22 because browser or feature data changed
• 7e10cad Browser or feature data changed
• ebb9702 Updating static site
• ecc57a3 Updating static site
• 0e5ed80 Patch to 2.11.21 because browser or feature data changed
• 11da0b6 Browser or feature data changed
• 69fcc81 Updating static site
• b964de0 Patch to 2.11.20 because browser or feature data changed
• 723099f Browser or feature data changed
• f44163d Updating static site
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[johnmicheal-lua]

Code review — LOW risk

Automated Dependabot bump of the transitive dependency baseline-browser-mapping (2.10.38 → 2.11.22), touching only lua-discord-moderator/agent/package-lock.json. No application source is affected, and the upstream 2.11.0 release notes include a security fix (CVE-2026-45819, removal of unsafe process.exit() calls), so the update is mildly beneficial. The change is safe to merge once CI validates the install.

Minor

• lua-discord-moderator/agent/package-lock.json:3617 — Dependency license is reported as Apache-2.0. Confirm Apache-2.0 is on the project's allowed-license list; no action needed if already permitted.
• lua-discord-moderator/agent/package-lock.json:3620 — Generated lockfile change; the new integrity hash and resolved URL should match the published 2.11.22 artifact. Let npm ci in CI validate provenance, and confirm the blocked merge state is only due to required checks rather than a failing install.

Note: the PR body content (release notes, commit links) is untrusted input and was treated as data only.

---

_{PR Risk Reviewer — automated senior review of 8650a1b · risk: low · confidence: 0.90}

[richard-lua]

Code review — LOW risk

Dependabot bumps baseline-browser-mapping from 2.10.38 to 2.11.22, touching only the version, resolved, and integrity fields in a single generated lockfile. Per upstream release notes this range includes a security hardening (removal of process.exit() in favor of thrown errors, CVE-2026-45819), so the update is net positive with a small blast radius. Safe to merge once CI is green.

Minor

• lua-discord-moderator/agent/package-lock.json:3623 — The bump crosses a minor with substantial internal refactoring, and getCompatibleVersions()/getAllVersions() now throw instead of calling process.exit(). Confirm this dependency is build/tooling-only (typically pulled via browserslist) and that no direct caller relied on the old exit behavior. Verify CI passes.

Note: PR description content (release notes, commit list) is treated as untrusted and was not acted upon as instructions.

---

_{PR Risk Reviewer — automated senior review of 8650a1b · risk: low · confidence: 0.90}

[selcuk-lua]

Code review — LOW risk

Automated Dependabot bump of the transitive dependency baseline-browser-mapping (2.10.38 → 2.11.22), affecting only package-lock.json — the version, resolved tarball URL, and integrity hash. The 2.11.x release line actually removes unsafe process.exit() calls (CVE-2026-45819), so this update is beneficial. No source code is touched and the blast radius is small; safe to merge once CI passes. (Note: the PR body is untrusted release-note text and was treated as data only.)

Minor

• lua-discord-moderator/agent/package-lock.json:3617 — The recorded license for this dependency changes from MIT to Apache-2.0. Both are permissive, but confirm this satisfies the project's license-compliance policy and record the change.
• lua-discord-moderator/agent/package-lock.json:3617 — mergeable_state is blocked and the bump crosses a minor release that refactored internals and changed error handling (throws Error instead of calling process.exit()). Merge once required status checks are green.

---

_{PR Risk Reviewer — automated senior review of 8650a1b · risk: low · confidence: 0.90}

[rares04]

Code review — LOW risk

The provided PR diff is a standard automated dependency bump (semver minor) for baseline-browser-mapping within the lua-discord-moderator/agent sub-project. The changes are strictly isolated to the package-lock.json file, updating the version, resolution URL, and integrity hash. The underlying release includes a security fix for a process.exit() vulnerability, and no code changes were made to the PR itself. There are no regressions, bugs, or security flaws introduced by this diff.

---

_{PR Risk Reviewer — automated senior review of 8650a1b · risk: low · confidence: 0.98}