chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates

[dependabot]

Bumps the npm_and_yarn group with 3 updates in the /example directory: baseline-browser-mapping, browserslist and joi.

Updates baseline-browser-mapping from 2.9.7 to 2.11.26

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.0

What's Changed

• Introduces support for Node 6 by refactoring all Object.entries and Object.values instances and lowering ES target in Rollup to es2015.
• Adds specified Node version support in package.json for >=6.0.0.
• Refactors CLI code to avoid parseArgs which is not supported by versions of Node prior to 18, changes import to require and changes Rollup export to cjs to allow execution on older versions of Node.
• Adds a new legacy-test.js file that allows basic testing on older versions of Node where current versions of Jasmine and ESLint are not supported.
• Adds a test matrix to run tests on all even-numbered Node versions from 6 to 24.
• refactor publish workflows to support NPM's new OIDC integration

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.24...v2.10.0

Commits

• c1934c6 Patch to 2.11.26 because browser or feature data changed
• 4873684 Browser or feature data changed
• 9030798 Updating static site
• a5df351 Updating static site
• ecc5b54 Updating static site
• 719bf7a Patch to 2.11.25 because browser or feature data changed
• c4f5b49 Browser or feature data changed
• aa194af Updating static site
• 0d33c4a Patch to 2.11.24 because browser or feature data changed
• 1dac891 Browser or feature data changed
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for baseline-browser-mapping since your current version.

Updates browserslist from 4.28.1 to 4.29.1

Release notes

Sourced from browserslist's releases.

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

Changelog

Sourced from browserslist's changelog.

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improved or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

Commits

• d539317 Release 4.29.1 version
• 5618b50 Update dependencies
• 1078f90 Fix config loading protection for Windows
• 7f0971c Merge pull request #951 from charmander/resolve-filter-cleanup
• 5bd707a Merge pull request #950 from charmander/usage-filter-cleanup
• a42d9e3 Merge pull request #949 from wahidrizka/fix-case-insensitive-stats-supports
• 7cce1ec cleanup: Combine equivalent not/and not logic; implement and as opposit...
• 6a13e4b cleanup: Use common function to filter versions by usage predicate
• a3dd621 Make percentage and supports queries case-insensitive
• 6d6530b Merge pull request #948 from jakezwang/fix-case-insensitive-not
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates joi from 17.13.4 to 17.13.8

Commits

• 4ae6af9 17.13.8
• b3ed6fb Merge pull request #3153 from hapijs/fix/messages-proto-flat-v17
• 1d2001c chore: backport #3151
• ed9d7cd 17.13.7
• f2729f7 Merge pull request #3145 from hapijs/backport/isodate-timeshift-v17
• c43fc96 chore: add regression test for #3143
• 115e7b5 fix(isoDate): pad a bare-hour timeshift with a colon, not just zeros
• 850be1e 17.13.6
• 9faeecc Merge pull request #3139 from hapijs/chore/backport-messages-proto
• 8d0b808 fix: prevent messages proto injection
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Lockfile-only updates in the example app; security and bugfix patches in dev/build transitive deps with no runtime app code changes.

Overview
Updates example/yarn.lock only (Dependabot grouped bump). No application source changes.

baseline-browser-mapping (2.9.7 → 2.11.26) and browserslist (4.28.1 → 4.29.1) move forward together with refreshed browser data (caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db). These are transitive build/tooling dependencies (e.g. Babel/Metro browser targeting), not direct example/package.json deps.

joi bumps 17.13.4 → 17.13.8 via @react-native-community/cli (config/doctor), picking up validation hardening (e.g. messages proto injection fixes) and small isoDate fixes.

The lockfile also refreshes the file:../package resolution hash/checksum for @ketch-com/ketch-react-native, reflecting the current local package snapshot when the lock was regenerated—not a published version change.

^{Reviewed by Cursor Bugbot for commit 985129c. Configure here.}

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.