chore(deps): bump browserslist from 4.28.2 to 4.28.9 in /lua-shopping-assistant

[dependabot]

Bumps browserslist from 4.28.2 to 4.28.9.

Release notes

Sourced from browserslist's releases.

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

Changelog

Sourced from browserslist's changelog.

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

Commits

• 12ed525 Release 4.28.9 version
• b1d8cf9 Update dependencies
• 21517b6 Improve or parsing performance
• f2f2e6c Release 4.28.8 version
• d0787c8 Update dependencies
• fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
• 57ecd64 fix: support "including kaios" without downstream
• 093a0f6 Update EM banner
• b637868 Release 4.28.7 version
• 313f465 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

[richard-lua]

Code review — HIGH risk

Presented as a routine Dependabot browserslist bump (4.28.2 → 4.28.9), the lockfile diff also quietly upgrades the first-party lua-cli dependency from ^3.29.1 to ^3.30.0 in the manifest and pins its resolved version to 3.32.1 — a multi-minor jump of the core framework this demo is built on, unrelated to the stated purpose. The browserslist-family transitive bumps (caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db, baseline-browser-mapping) are expected and low risk, but the out-of-scope lua-cli change should not merge under this title without human review and testing.

Major

• lua-shopping-assistant/package-lock.json:18 — The PR claims only a browserslist bump, yet it also changes lua-cli from ^3.29.1 → ^3.30.0 (manifest) and 3.29.1 → 3.32.1 (resolved). lua-cli is the primary framework for this demo, making this a high-blast-radius, potentially behavior-changing upgrade smuggled into a chore(deps) browserslist PR. Resolution: Split the lua-cli upgrade into its own reviewed/tested PR; regenerate this lockfile so it only touches browserslist and its transitives, or explicitly confirm and document the intentional grouping.

Minor

• lua-shopping-assistant/package-lock.json:3608 — Transitive bumps (caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db, baseline-browser-mapping) carry new integrity hashes that cannot be verified from the patch alone. Resolution: Let CI run npm ci to validate integrity and confirm no unexpected packages were added/removed.

---

_{PR Risk Reviewer — automated senior review of 7cd29af · risk: high · confidence: 0.82}

[johnmicheal-lua]

Code review — HIGH risk

This is nominally a Dependabot patch bump of browserslist (4.28.2 → 4.28.9), and the browserslist plus transitive updates are routine build-tooling refreshes. However, the same lockfile diff also bumps lua-cli from 3.29.1 to 3.32.1 — a two-minor-version jump of this repo's core CLI dependency that is unrelated to browserslist and undisclosed in the PR title/body. That undisclosed change is the real risk and should be confirmed by a human before merge.

Major

• lua-shopping-assistant/package-lock.json:5071 — The PR claims a browserslist-only bump, but lua-cli moves 3.29.1 → 3.32.1, and the manifest range at the top of the lock ("lua-cli": "^3.30.0") matches neither the old version nor the title. lua-cli is central to all four demo apps, so a silent minor bump can carry cross-cutting behavior changes. Resolution: Confirm intent; split the lua-cli upgrade into its own PR with changelog review, or explicitly document and CI-validate it here.

Minor

• lua-shopping-assistant/package-lock.json:3607 — Transitive deps (baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db) were all refreshed as expected for a browserslist bump. Resolution: Just confirm npm ci resolves the new integrity hashes cleanly in CI; no further action needed.

---

_{PR Risk Reviewer — automated senior review of 7cd29af · risk: high · confidence: 0.72}

[johnmicheal-lua]

Code review — LOW risk

Previously flagged

• Previously flagged Undisclosed lua-cli bump (3.29.1 → 3.32.1) mismatches PR scope — resolved: the new revision (ee659a4) narrows the lockfile diff to browserslist and its five expected transitive browser-data dependencies only; no lua-cli change remains.
• Previously flagged Transitive dependency versions exceed stated browserslist range floors — resolved: browserslist 4.28.9's declared dependency floors now align with the resolved transitive versions in the same diff (nothing exceeds its range).

This is now a clean, in-scope Dependabot patch bump of browserslist (4.28.2 → 4.28.9) with the routine transitive refreshes (baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db). These are build-time browser-data packages with no runtime blast radius. Safe to merge once CI confirms npm ci resolves the new integrity hashes cleanly.

No new issues found.

---

_{PR Risk Reviewer — automated senior review of ee659a4 · risk: low · confidence: 0.80 · re-review}

[richard-lua]

Code review — LOW risk

Previously flagged

• Previously flagged Out-of-scope lua-cli bump hidden in a browserslist PR — resolved: the updated revision (head ee659a4) drops the lua-cli manifest/resolved change entirely, so the patch is now scoped correctly to browserslist and its transitives.
• Still open (advisory only): Transitive integrity/version bumps unverifiable from patch alone — inherent to lockfile diffs; CI validation covers it.

This revision is a clean, in-scope Dependabot bump: browserslist 4.28.2 → 4.28.9 plus its expected transitive updates (baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db). No out-of-scope framework changes remain. Blast radius is limited to a build-time browser-targeting dependency.

Minor

• lua-shopping-assistant/package-lock.json:3604 — New resolved URLs and integrity hashes for the five browserslist transitives cannot be verified from the diff alone. Resolution: allow CI npm ci to validate integrity and confirm no unexpected packages were added/removed.

---

_{PR Risk Reviewer — automated senior review of ee659a4 · risk: low · confidence: 0.80 · re-review}