chore: upgrade baseline-browser-mapping to 2.11.21 to address CVE-2026-45819

[claude]

Fixes SOU-2202

Refreshes the yarn.lock entries for baseline-browser-mapping, which now dedupe onto 2.11.21.

baseline-browser-mapping is not a direct dependency of any workspace. It arrived twice: through browserslist at ^2.11.12 (already resolving to a patched 2.11.20) and through next at ^2.9.19, which was stale at the affected 2.10.13. Both ranges already admitted the patched release, so this is a lockfile refresh only. No package.json change and no resolutions override were needed.

Advisory addressed

Advisory	Patched in	Summary
CVE-2026-45819	2.11.0	Calls process.exit() instead of throwing on invalid or conflicting input parameters, allowing immediate process termination

Verification

• yarn why baseline-browser-mapping reports every instance resolving to baseline-browser-mapping@npm:2.11.21, with 2.10.13 gone from the graph.
• yarn workspace @sourcebot/web test --run — 140 files, 1440 tests passed.
• yarn workspace @sourcebot/web build — succeeded. Included because this package feeds browserslist target resolution at build time.

🤖 Generated with Claude Code

---

Note

Low Risk
Lockfile-only transitive dependency bump for a security advisory; no application code or direct dependency version changes.

Overview
Refreshes yarn.lock so every transitive baseline-browser-mapping instance resolves to 2.11.21, removing the stale 2.10.13 copy that came in through next while browserslist was already on a newer line.

There are no package.json or resolutions changes—existing semver ranges already allowed the patched release. The [Unreleased] changelog records the upgrade under Fixed.

This addresses CVE-2026-45819, where invalid or conflicting CLI input could trigger process.exit() instead of a thrown error and terminate the Node process.

^{Reviewed by Cursor Bugbot for commit e1069a4. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Fixes SOU-2202 by upgrading baseline-browser-mapping to 2.11.21 in yarn.lock, addressing CVE-2026-45819. This is a lockfile-only refresh; both browserslist and next already permitted the patched version.

• yarn why confirms all instances resolve to 2.11.21.
• Workspace tests and build pass.

^{Written for commit b088139. Summary will update on new commits.}

[github-actions]

@claude[bot] your pull request is missing a changelog!

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.