browserslist - npm Package Compare versions

Comparing version 4.22.3 to 4.23.0

index.d.ts

@@ -196,2 +196,3 @@ /**
       BROWSERSLIST_STATS?: string
+      BROWSERSLIST_ROOT_PATH?: string
     }
@@ -198,0 +199,0 @@ }

node.js

@@ -53,2 +53,3 @@ var feature = require('caniuse-lite/dist/unpacker/feature').default
   do {
+    if (!pathInRoot(loc)) break;
     var result = callback(loc)
@@ -60,2 +61,11 @@ if (typeof result !== 'undefined') return result
 
+function pathInRoot(p) {
+  if (!process.env.BROWSERSLIST_ROOT_PATH) return true
+  var rootPath = path.resolve(process.env.BROWSERSLIST_ROOT_PATH);
+  if (path.relative(rootPath, p).substring(0,2) === '..') {
+    return false;
+  }
+  return true
+}
+
 function check(section) {
@@ -62,0 +72,0 @@ if (Array.isArray(section)) {

package.json

 {
   "name": "browserslist",
-  "version": "4.22.3",
+  "version": "4.23.0",
   "description": "Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset",
@@ -28,4 +28,4 @@ "keywords": [
   "dependencies": {
-    "caniuse-lite": "^1.0.30001580",
-    "electron-to-chromium": "^1.4.648",
+    "caniuse-lite": "^1.0.30001587",
+    "electron-to-chromium": "^1.4.668",
     "node-releases": "^2.0.14",
@@ -32,0 +32,0 @@ "update-browserslist-db": "^1.0.13"

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

62763

increased by0.51%

Lines of code

1958

increased by0.51%

Worsened metrics

Number of low supply chain risk alerts

26

increased by8.33%

Dependency changes

• Updatedcaniuse-lite@^1.0.30001587

• Updatedelectron-to-chromium@^1.4.668