chore(deps-dev): bump the minor-and-patch group with 4 updates

[dependabot]

Bumps the minor-and-patch group with 4 updates: baseline-browser-mapping, js-yaml, postcss and through2.

Updates baseline-browser-mapping from 2.10.43 to 2.11.4

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.9.3 - remove process.loadEnvFile()

What's Changed

• Remove process.loadEnfFile() from main script by @​tonypconway in web-platform-dx/baseline-browser-mapping#112

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.2...v2.9.3

Commits

• 3181ec7 Patch to 2.11.4 because browser or feature data changed
• 433f067 Browser or feature data changed
• f10fc63 Updating static site
• 5098389 Patch to 2.11.3 because browser or feature data changed
• 12b1a19 Browser or feature data changed
• 001faf1 Patch to 2.11.2 because browser or feature data changed
• 9b11b2d Browser or feature data changed
• 67502fe Updating static site
• 0a7ce51 Patch to 2.11.1 because browser or feature data changed
• 3f08bfe Browser or feature data changed
• Additional commits viewable in compare view

Updates js-yaml from 5.2.1 to 5.2.2

Changelog

Sourced from js-yaml's changelog.

[5.2.2] - 2026-07-24

Fixed

• Quote flow scalars where a colon precedes a flow indicator, #773.

Security

• Avoid exponential parsing time for nested flow sequence pairs.

Commits

• 3c29559 5.2.2 released
• 3e5240f parser: avoid reparsing flow sequence pair keys
• bd7ebb2 fix: quote flow scalars where a colon precedes a flow indicator (#773)
• See full diff in compare view

Updates postcss from 8.5.20 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

Changelog

Sourced from postcss's changelog.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

Commits

• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• Additional commits viewable in compare view

Updates through2 from 5.0.5 to 5.0.7

Release notes

Sourced from through2's releases.

v5.0.7

5.0.7 (2026-07-23)

v5.0.6

5.0.6 (2026-07-21)

Changelog

Sourced from through2's changelog.

5.0.7 (2026-07-23)

5.0.6 (2026-07-21)

Commits

• 598513d chore(release): 5.0.7 [skip ci]
• 27061ac chore(ci): switch to hashes for versioning
• 9839c29 chore(deps): bump actions/checkout from 7.0.0 to 7.0.1
• dd42ae8 chore(release): 5.0.6 [skip ci]
• 1c9d76f chore(ci): don't use cached lts version
• 4824b24 chore(deps): add readable-stream types
• 59a2c3f chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions