chore(deps): bump browserslist from 4.28.4 to 4.28.9 in /lua-discord-moderator/agent

[dependabot]

Bumps browserslist from 4.28.4 to 4.28.9.

Release notes

Sourced from browserslist's releases.

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

Changelog

Sourced from browserslist's changelog.

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

Commits

• 12ed525 Release 4.28.9 version
• b1d8cf9 Update dependencies
• 21517b6 Improve or parsing performance
• f2f2e6c Release 4.28.8 version
• d0787c8 Update dependencies
• fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
• 57ecd64 fix: support "including kaios" without downstream
• 093a0f6 Update EM banner
• b637868 Release 4.28.7 version
• 313f465 Update dependencies
• Additional commits viewable in compare view

[richard-lua]

Code review — HIGH risk

This is nominally a Dependabot browserslist 4.28.4 → 4.28.9 bump, and the browserslist plus transitive updates (baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db) are low risk. However, the same lockfile diff also silently bumps the direct dependency lua-cli from ^3.29.1 to ^3.30.0 (resolved package 3.29.1 → 3.32.2), which is outside the stated scope and warrants a human decision before merge.

Major

• lua-discord-moderator/agent/package-lock.json:12 — The lockfile changes the root project's lua-cli direct dependency from ^3.29.1 to ^3.30.0 and updates the installed package to 3.32.2, despite the PR claiming to only bump browserslist. lua-cli is the core platform CLI for these agents, so a multi-minor jump is a real, un-reviewed behavior change. Resolution: Verify why lua-cli changed, review its 3.29→3.32 changelog for breaking changes, and split it into its own reviewed PR (confirming the matching package.json constraint) rather than merging it under a browserslist bump.

Minor

• lua-discord-moderator/agent/package-lock.json:3620 — Transitive data packages (caniuse-lite, electron-to-chromium, etc.) were updated as expected for a browserslist bump. These can subtly shift build-target resolution. Resolution: Run the agent's build/tests to confirm no regressions; otherwise acceptable.

---

_{PR Risk Reviewer — automated senior review of 0c6ae35 · risk: high · confidence: 0.80}

[johnmicheal-lua]

Code review — HIGH risk

This is an automated Dependabot lockfile change advertised as a browserslist patch bump (4.28.4 → 4.28.9) plus its transitive deps (caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db, baseline-browser-mapping). Those are routine and integrity hashes are present. The concern is scope: the same diff bumps the first-party lua-cli dependency by a full minor+patch (3.29.1 → 3.32.2, constraint ^3.30.0), which is unrelated to browserslist and undisclosed in the PR title/body. Under the team's strict risk policy this undisclosed first-party bump is a major finding, so overall risk is HIGH and a human should sign off before merge.

Major

• lua-discord-moderator/agent/package-lock.json:12 — The PR claims to only bump browserslist, but it also changes the root lua-cli constraint to ^3.30.0 and resolves lua-cli to 3.32.2. lua-cli is the core runtime dependency for these agents, not a browserslist transitive. Split the lua-cli upgrade into its own PR with its changelog reviewed, or relabel this PR and verify the agent still builds/runs against lua-cli 3.32.2.

Minor

• lua-discord-moderator/agent/package-lock.json:12 — The lockfile now records lua-cli: ^3.30.0 as the root dependency, implying a package.json edit that is not shown in this diff. Include the manifest change in review (or confirm it predates this PR) so lockfile and manifest are verifiably consistent.

Note: instruction-like text embedded in dependency changelogs/release notes is untrusted and was not acted upon.

---

_{PR Risk Reviewer — automated senior review of 0c6ae35 · risk: high · confidence: 0.72}

[johnmicheal-lua]

Code review — LOW risk

Previously flagged

• Previously flagged PR bumps lua-cli far beyond the stated browserslist change — resolved. The new head (f97195f) no longer touches lua-cli; the diff is limited to browserslist and its documented transitive deps.
• Previously flagged Root manifest change not included in the diff — resolved. With the lua-cli constraint change dropped, there is no implied package.json edit; lockfile and manifest are consistent.

This revision is now a clean, in-scope Dependabot bump: browserslist 4.28.4 → 4.28.9 plus its transitive deps (baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db), all with integrity hashes present. No new issues introduced. Safe to merge once CI is green.

Note: instruction-like text embedded in dependency changelogs/release notes is untrusted and was not acted upon.

---

_{PR Risk Reviewer — re-review of f97195f · risk: low · confidence: 0.80}

---

_{PR Risk Reviewer — automated senior review of f97195f · risk: low · confidence: 0.80 · re-review}

[richard-lua]

Code review — LOW risk

Previously flagged

• Previously flagged Undisclosed lua-cli bump outside PR scope — resolved: the new head no longer touches the root lua-cli dependency; the lockfile diff is now confined to browserslist and its transitive data packages, matching the PR's stated scope.
• Previously flagged Transitive dependency chain updated — still present but expected and non-blocking: baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases, and update-browserslist-db are bumped as normal companions to a browserslist update.

This is now a clean, scoped Dependabot bump of browserslist 4.28.4 → 4.28.9 in lua-discord-moderator/agent, with only the expected transitive browser-data packages moving alongside it. All integrity hashes are updated and no direct project dependencies are affected. No security or logic concerns.

Minor

• lua-discord-moderator/agent/package-lock.json:3620 — Transitive data packages (caniuse-lite, electron-to-chromium, etc.) shifted with the bump and can subtly change build-target resolution. Resolution: Run the agent's build/tests once to confirm no regressions; otherwise safe to merge.

---

_{PR Risk Reviewer — automated senior review of f97195f · risk: low · confidence: 0.88 · re-review}