build(deps-dev): bump browserslist from 4.28.0 to 4.28.9

[dependabot]

Bumps browserslist from 4.28.0 to 4.28.9.

Release notes

Sourced from browserslist's releases.

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

4.28.1

• Removed Baseline warning since we have it own warning.

Changelog

Sourced from browserslist's changelog.

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

4.28.1

• Removed Baseline warning since we have it own warning.

4.48.0

• Added firefox >= esr query support (by @​SethFalco).
• Fixed docs (by @​SethFalco).

4.27.0

• Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

• Fixed throwOnMissing with extends query (by @​alexander-akait).

... (truncated)

Commits

• 12ed525 Release 4.28.9 version
• b1d8cf9 Update dependencies
• 21517b6 Improve or parsing performance
• f2f2e6c Release 4.28.8 version
• d0787c8 Update dependencies
• fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
• 57ecd64 fix: support "including kaios" without downstream
• 093a0f6 Update EM banner
• b637868 Release 4.28.7 version
• 313f465 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

[github-actions]

🤖 Codex-Style Code Review by OpenCode (Vue Best Practice Enabled)

💡 Autonomous AI Reviewer inspecting git commit history and Vue code quality.

This PR is a simple dependency bump — only package-lock.json is modified, with no source code changes.

Code Review — PR #210

Title: build(deps-dev): bump browserslist from 4.28.0 to 4.28.9
Base: origin/main → HEAD (pull/210/merge)

---

Summary

Aspect	Detail
Commits	2 (merge commit + single build(deps-dev) commit)
Files changed	1 (package-lock.json)
Source code changes	None

This is an automated Dependabot dependency bump for the dev dependency browserslist (4.28.0 → 4.28.9). The PR updates only package-lock.json, pulling in newer versions of transitive dependencies:

• baseline-browser-mapping 2.8.28 → 2.11.21
• caniuse-lite 1.0.30001754 → 1.0.30001810
• electron-to-chromium 1.5.253 → 1.5.422
• node-releases 2.0.27 → 2.0.54
• update-browserslist-db (implied transitive bump)

Review Findings

✅ No blocking issues

• No source code changes — no Vue components, composables, templates, or configuration files are modified.
• Dev-only dependency — browserslist is listed under devDependencies, so this has zero impact on the production bundle.
• Lock file only — the diff is confined to package-lock.json, which is expected for this type of automated PR.
• Integrity hashes present — the lock file correctly includes resolved URLs and integrity checksums for all bumped packages.

🟢 Minor observations (non-blocking)

1. CI should verify — ensure the project's test suite and build pass after merging. Since this is a dev tooling dependency (browser targeting data), there's a small chance that updated caniuse-lite data could affect build output or CSS/JS target compatibility. The CI pipeline should confirm no regressions.

2. Transitive dependency scope — the bump cascades through several transitive deps (baseline-browser-mapping, caniuse-lite, electron-to-chromium, node-releases). This is normal for browserslist updates but worth noting for traceability.

Verdict

Decision	✅ Approve

This is a routine, low-risk automated dependency update with no source code changes. Safe to merge once CI passes.