[dependabot]

Bumps browserslist from 4.29.2 to 4.29.4.

Release notes

Sourced from browserslist's releases.

4.29.4

• Fixed joined version bounds in version ray and range queries (by @​ybai08).
• Fixed whitespaces processing (by @​abhu85).

4.29.3

• Updated Firefox ESR.

Changelog

Sourced from browserslist's changelog.

4.29.4

• Fixed joined version bounds in version ray and range queries (by @​ybai08).
• Fixed whitespaces processing (by @​abhu85).

4.29.3

• Updated Firefox ESR.

Commits

• f7a99b9 Release 4.29.4 version
• 03fc702 Update dependencies
• efe07e1 Merge pull request #956 from ybai08/fix-joined-range-bounds
• ef50f5b Fix joined version bounds in version ray and range queries
• 8219dd7 Merge pull request #954 from abhu85/fix-since-extends-whitespace
• 893120b Allow arbitrary whitespaces in since, extends, config and not queries
• b4809dd Release 4.29.3 version
• 9d844f8 Update Firefox ESR
• 0033f34 Update dependencies
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

APPROVE — patch bump of a dev-only tool with two small bug fixes and no breaking changes.

Package	Jump	CI	Risk
browserslist (devDependencies, exact pin)	4.29.2 → 4.29.4	still running at review time (Android compile and release build smoke passed)	low

What changed

• 4.29.3: Firefox ESR data update.
• 4.29.4: fixed joined version bounds in version-ray and range queries.
• 4.29.4: fixed whitespace handling in since, extends, config and not queries.
• The lockfile also moves the transitive data packages (baseline-browser-mapping, caniuse-lite, electron-to-chromium). No new install scripts were added.

Blast radius: only tools/report-browser-floor.mjs and its test, tools/tests/report-browser-floor.test.mjs, use it. It's a devDependency and stays one, so the Netlify --prod install isn't affected (ADR-0070). Because the data is refreshed, the browser-floor report output may shift slightly. Check that the report test passes when CI finishes.

[KyleMit]

MERGE

Merge 9 of 11, wave 2. Needs a Dependabot rebase after wave 1, because it conflicts with #3186 and #3197.

• browserslist 4.29.2 → 4.29.4, patch, exact pin, devDependencies. Used by tools/report-browser-floor.mjs.
• CI on this head: everything except Quality's audit step is green.

Quality is red on every PR in the batch and on main (ef3d1eb) at its last step, Audit dependencies: vite 8.3.1 (high), handlebars 4.7.9 via @capacitor/assets (critical), source-map-js 1.2.1 (high), uuid 7.0.3 and postcss-selector-parser 7.1.5 (moderate). Every earlier Quality step (format, type check, lint, knip, production deps) passed on this PR. With the whole batch applied via npm pkg set, pnpm audit clears only @vitest/mocker (2 moderate, #3186) and cookie (1 low, #3187). Quality stays red after the batch and needs its own fix; it is not this PR's failure.

Batch — 15 open Dependabot PRs (npm 14 of its 30-PR limit, actions 1 of 10, so nothing is queued behind the limit). Wave 1, in this order, simulated with chained git merge-tree plus a unique-key pnpm-lock.yaml parse, clean at every step: #3186 → #3189 → #3192 → #3194 → #3197 → #3198. Wave 2, one Dependabot rebase each after wave 1 lands, because each conflicts in package.json/pnpm-lock.yaml with a wave-1 PR: #3188, #3190, #3191, #3193, #3195. HOLD: #3184, #3196. Recommended CLOSE: #3185, #3187.

🤖 Generated with Claude Code

---

Generated by Claude Code