refactor: Bump baseline-browser-mapping from 2.10.12 to 2.11.25

[dependabot]

Issue

baseline-browser-mapping is affected by an open Dependabot security alert (medium severity, vulnerable range >= 2.0.0, < 2.11.0, patched in 2.11.0). The advisory (CVE-2026-45819) covers process.exit() calls reachable from getCompatibleVersions() / getAllVersions() when unsupported option combinations are passed.

Approach

Bump the transitive, development-only dependency baseline-browser-mapping from 2.10.12 to 2.11.25 in package-lock.json. package.json is unchanged.

The package is pulled in by browserslist and is not part of Parse Server's published runtime dependency tree, so this has no effect on consumers. Parse Server does not call the package directly, so the process.exit() to throw Error change in 2.11.0 has no call sites here. Versions 2.11.1–2.11.25 are data-only patches (browser/feature data refreshes).

Tasks

• Add security check — resolves the open Dependabot alert for baseline-browser-mapping

---

_{Original Dependabot description below.}

Bumps baseline-browser-mapping from 2.10.12 to 2.11.25.

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

• 719bf7a Patch to 2.11.25 because browser or feature data changed
• c4f5b49 Browser or feature data changed
• aa194af Updating static site
• 0d33c4a Patch to 2.11.24 because browser or feature data changed
• 1dac891 Browser or feature data changed
• aff3369 Updating static site
• ebdc72f Patch to 2.11.23 because browser or feature data changed
• 55fa3a1 Browser or feature data changed
• 5ac60db Updating static site
• af7c3c4 Patch to 2.11.22 because browser or feature data changed
• Additional commits viewable in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.82%. Comparing base (8d22053) to head (17bda57).
⚠️ Report is 1 commits behind head on alpha.

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha   #10656      +/-   ##
==========================================
- Coverage   93.84%   93.82%   -0.02%     
==========================================
  Files         192      192              
  Lines       16875    16875              
  Branches      252      252              
==========================================
- Hits        15836    15833       -3     
- Misses       1017     1020       +3     
  Partials       22       22              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b4115649-a8ce-439a-bc34-38feac54a262

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[mtrezza]

@coderabbitai full review

[mtrezza]

@coderabbitai review

[mtrezza]

Closing as already upgraded.

baseline-browser-mapping is now at 2.11.25 on alpha — the exact target of this PR — pulled in by #10652 (browserslist 4.28.1 → 4.29.0), which raised its own constraint from ^2.9.0 to ^2.11.23 and resolved the identical version.

This also resolves the Dependabot alert for baseline-browser-mapping (GHSA / CVE-2026-45819, vulnerable >= 2.0.0, < 2.11.0), so no further action is needed here.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.