chore(deps-dev): bump baseline-browser-mapping from 2.10.42 to 2.11.22

[dependabot]

Bumps baseline-browser-mapping from 2.10.42 to 2.11.22.

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

• af7c3c4 Patch to 2.11.22 because browser or feature data changed
• 7e10cad Browser or feature data changed
• ebb9702 Updating static site
• ecc57a3 Updating static site
• 0e5ed80 Patch to 2.11.21 because browser or feature data changed
• 11da0b6 Browser or feature data changed
• 69fcc81 Updating static site
• b964de0 Patch to 2.11.20 because browser or feature data changed
• 723099f Browser or feature data changed
• f44163d Updating static site
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[clestons]

✅ APPROVE — #35

Head: 7192e9c · dependabot · baseline-browser-mapping 2.10.42 → 2.11.22（devDependency）· 2 文件 +5/−5
轮次: 2-round（纯依赖升级）· R1a+R1b DeepSeek → 判断由执行者做

作者意图（一句话）：把一个开发期依赖的浏览器兼容数据升到新版。

核过的

• lockfile 的 integrity 与官方 registry 逐字一致：baseline-browser-mapping@2.11.22 lockfile 里的 sha512-pWc4w51f… = registry.npmjs.org 返回的 dist.integrity。
• resolved 从 registry.npmmirror.com 换成了 registry.npmjs.org（这一条目）。integrity 是内容哈希，和从哪个源下载无关 —— 上一条一致就说明换源没有夹带任何东西。lockfile 里其余条目仍指向 npmmirror，是混合源，但不影响安装（CI 的 Build 两腿都绿）。

⚠️ 这个 PR 上红着的 Security Audit 不是它引入的

失败原因是 npm audit --audit-level=critical 命中了唯一一个 critical：next 9.3.4-canary.0 – 16.3.2（中间件/Proxy 绕过、Server Actions SSRF、响应体缓存混淆等，见 GHSA-6gpp-xcg3-4w24 / GHSA-89xv-2m56-2m9x / GHSA-68g3-v927-f742）。main 上本来就是 next@16.2.10，这个 PR 一行没动 next。

同一时间的 #36（next → 16.3.3）审计是绿的（13 个漏洞、0 critical，对比这里 16 个、1 critical）。所以建议的顺序是：先合 #36，再让 #35 rebase，它的审计就会变绿。

结论

APPROVE。 纯开发期依赖升级，内容哈希核过；红灯来自 base 上的 next，不是这次改动。