chore(deps): update npm dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
baseline-browser-mapping	2.10.43 → 2.11.4
pnpm (source)	11.15.1 → 11.17.0
vega (source)	6.2.0 → 6.3.1

---

Release Notes

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.11.4

Compare Source

v2.11.3

Compare Source

v2.11.1

Compare Source

v2.11.0

Compare Source

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #​134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.44

Compare Source

pnpm/pnpm (pnpm)

v11.17.0: pnpm 11.17

Compare Source

Minor Changes

• Added a new setting, update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the GITHUB_SERVER_URL environment variable, falling back to https://github.com. The URL must use the https:// or http:// protocol #​13220.

  pnpm outdated and pnpm update no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.

  Setting update.githubActions to false now makes pnpm outdated and the interactive pnpm update skip GitHub Actions dependencies.

Patch Changes

• The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll pnpm/pnpm#12721.

• Fixed catalog: references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g. packages/foo) through a pnpr server #​13232.

• Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug #​13164.

• Revert script ordering change for pnpm run --sequential /regex/

• Support the from-git argument in the pnpm version command.

• When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.

Platinum Sponsors

Gold Sponsors

v11.16.0: pnpm 11.16

Compare Source

Minor Changes

• The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it. pnpm version -r and pnpm change status check the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at 1100.0.0 with a minor changeset is therefore published as 1100.0.0 rather than skipping straight to 1100.1.0.

• Added a --changeset flag to pnpm update. Set update.changeset to true in pnpm-workspace.yaml to enable this behavior by default, and use --no-changeset to override the setting for one update. After the update completes, pnpm writes a .changeset/pnpm-update-<suffix>.md file declaring a patch bump for every workspace package whose dependencies or optionalDependencies were changed by the update and a major bump when peerDependencies changed, including packages that consume an updated catalog entry via the catalog: protocol. Private packages, packages without a name, and packages listed in the ignore array of .changeset/config.json are skipped. If .changeset/config.json does not exist, a warning is printed and no changeset is generated.

• Added GitHub Actions dependencies to pnpm outdated and interactive pnpm update. Non-interactive updates can include them with --include-github-actions or by setting update.githubActions to true in pnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.

• Added update and audit settings sections to pnpm-workspace.yaml, superseding the awkwardly named updateConfig, auditConfig, and top-level auditLevel settings:

  update:
    ignoreDeps: # was updateConfig.ignoreDependencies
      - webpack
      - "@​babel/*"
  
  audit:
    level: high # was auditLevel
    ignore: # was auditConfig.ignoreGhsas
      - GHSA-xxxx-yyyy-zzzz

  update.ignoreDeps lists dependency name patterns that pnpm update and pnpm outdated should skip. audit.level and audit.ignore tune pnpm audit.

  The deprecated updateConfig, auditConfig, and auditLevel settings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.

Patch Changes

• Fixed pnpm add --save-exact/--save-prefix and pnpm update writing a package's version with the peerDependencies range's prefix (e.g. ^19.2.7 instead of the requested 19.2.7) whenever the same package also appeared in peerDependencies. A real dependencies/devDependencies/optionalDependencies entry now takes precedence over a same-named peerDependencies entry when computing the current specifiers #​13108.

Platinum Sponsors

Gold Sponsors

vega/vega (vega)

v6.3.1

Compare Source

v6.3.0

Compare Source

Changes since v6.2.0

Features

• Align legend and title labels to the start of the chart frame (thanks @​djbarnwal and @​domoritz!) (via #​4297, supersedes #​4052)
• Add "auto" unit and inferUnits option to the timeunit transform (thanks @​paulrosenzweig and @​domoritz!) (via #​4299, supersedes #​3645)
• Add integer tickIndex field on axis tick datums for use in label expressions (thanks @​hydrosquall!) (via #​4250)
• Add encodeURIComponent to built-in expressions (thanks @​danmarshall!) (via #​4148)
• Add encodeURIComponent to vega-interpreter (thanks @​danmarshall!) (via #​4196)

Fixes

• Expand stroke bounds by half the stroke width with join-aware slack; tighter bounds, miter joins now honored by default (thanks @​stas-sl and @​domoritz!) (via #​4302, supersedes #​3487)
• Respect CSS transforms when computing event points (thanks @​letelete and @​domoritz!) (via #​4301, supersedes #​3978)
• Correctly handle tickMinStep (thanks @​domoritz!) (via #​4162)
• Clamp negative variance deviation from streaming removes (thanks @​domoritz!) (via #​4298)
• Correct stdevp/variancep for the single-element population case (thanks @​soldenstoll and @​domoritz!) (via #​4296, supersedes #​4150)
• Fix bounds calculation for empty visualization with absent legend title (thanks @​betalb and @​domoritz!) (via #​4295, supersedes #​3936)
• Let axis description override the default aria-label (thanks @​MarcBaeuerle and @​domoritz!) (via #​4294, supersedes #​3991)
• Correct stacking behaviour for null and empty-string categories (thanks @​MarcBaeuerle and @​domoritz!) (via #​4292, supersedes #​3992)
• Return adjusted stop from bin transform (thanks @​domoritz!) (via #​3967)
• Parse SVG paths containing a z (closepath) without a following space separator (thanks @​hydrosquall!) (via #​4236)
• Make the max interval of the crossfilter transform exclusive, not inclusive (thanks @​hydrosquall!) (via #​4231)
• Replace dots with underscores in aggregated field names (thanks @​basbroek!) (via #​4156)
• Preserve sign of frame bounds in the window transform (thanks @​btroop!) (via #​4153)
• Avoid prototype pollution in mergeConfig (already published in vega-util 2.1.1) (thanks @​domoritz!) (via #​4273)
• Security fixes merged from private forks (vega-expression codegen, vega-interpreter evaluation, vega-functions modify, vega-selections tuples); the vega-expression fix is first published with this release
• Fix docstring / function argument validation in vega-selections (already published in 6.1.2) (thanks @​hydrosquall!) (via #​4181)
• Adjust order of ObjectExpression evaluation in vega-interpreter (already published in 2.2.0) (thanks @​hydrosquall!) (via #​4138)
• Include build files in vega-interpreter npm releases (already published in 2.2.1) (thanks @​domoritz!) (via #​4139)

Maintenance

• Migrate vega-util to TypeScript (thanks @​hydrosquall!) (via #​4185, #​4187, #​4188, #​4189, #​4200, #​4202, #​4203, #​4218, #​4219, #​4220, #​4222)
• Compare scenegraph tests against goldens by default (thanks @​domoritz!) (via #​4305)
• Raise CI minimum Node.js version to 22 (via #​4286)
• Lint tooling updates: eslint 10, prettier 3.9, husky + lint-staged pre-commit linting (via #​4303, #​4230)
• Add package metadata for homepage and issues (via #​4282)
• Update node and TypeScript configuration at the repo root (via #​4184)
• Numerous dependency bumps via dependabot (lerna 9, rollup, babel, jsdom, canvas, d3-format, GitHub Actions, and more)
• Docs: use the main data set for the domain in the grouped bar chart example (thanks @​sl-solution!) (via #​3593); zoomable scatter plot example cleanup (via #​4217); grammar and typo fixes (via #​4157, #​4172, #​4175, #​4199)

Package versions

Package	Old	New	Reason
vega	6.2.0	6.3.0	minor — aggregates all changes
vega-cli	6.2.0	6.3.0	released alongside vega — its exact vega pin must match the workspace version
vega-crossfilter	5.1.0	5.1.1	fix (#​4231)
vega-dataflow	6.1.0	6.1.1	dependency ranges
vega-encode	5.1.0	5.2.0	feat (#​4250), fix (#​4292)
vega-expression	6.1.0	6.2.0	feat (#​4148), security fix
vega-force	5.1.0	5.1.1	dependency ranges
vega-format	2.1.0	2.1.1	dependency ranges
vega-functions	6.1.1	6.1.2	dependency ranges
vega-geo	5.1.0	5.1.1	dependency ranges
vega-hierarchy	5.1.0	5.1.1	dependency ranges
vega-interpreter	2.2.1	2.3.0	feat (#​4196)
vega-label	2.1.0	2.1.1	dependency ranges
vega-loader	5.1.0	5.1.1	dependency ranges
vega-parser	7.1.0	7.1.1	fix (#​4156)
vega-projection	2.1.0	2.1.1	dependency ranges
vega-projection-extended	3.1.0	3.1.1	dependency ranges
vega-regression	2.1.0	2.1.1	dependency ranges
vega-runtime	7.1.0	7.1.1	dependency ranges
vega-scale	8.1.0	8.1.1	fix (#​4162)
vega-scenegraph	5.1.0	5.2.0	behavior-visible fixes (#​4302, #​4301, #​4294, #​4236)
vega-schema	6.2.0	6.3.0	regenerated schema (adds inferUnits)
vega-selections	6.1.2	6.1.3	dependency ranges
vega-time	3.1.0	3.2.0	feat (#​4299)
vega-transforms	5.1.0	5.2.0	feat (#​4299), fixes (#​4298, #​4296, #​3967, #​4153)
vega-typings	2.1.0	2.2.0	feat typings (#​4297, #​4299)
vega-view	6.1.0	6.1.1	dependency ranges
vega-view-transforms	5.1.0	5.2.0	feat (#​4297), fix (#​4295)
vega-voronoi	5.1.0	5.1.1	dependency ranges
vega-wordcloud	5.1.0	5.1.1	dependency ranges

Unchanged (nothing new since their last publish): vega-canvas 2.0.0, vega-event-selector 4.0.0, vega-statistics 2.0.0, vega-util 2.1.1. Unlike v6.2.0's two-step release (#​4132), vega-cli ships in this release: it pins vega to an exact version, so leaving it at 6.2.0 while the workspace moves to 6.3.0 makes npm install a nested registry copy of vega instead of linking the workspace package, which breaks the build ordering and CI.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.