suggestion: deactivate dangerousExtend feature by default

[timomayer]

A few days ago i sent in a PR to make dangerousExtend available as environment varable but then i realized that does still not help in all cases because IDE implemented lint tools like eslint vscode plugin can still not be configured to use it.

Since eslint and stylelint both come with a very similar extend functionallity but both without this security feature, i vote for disabling the feature per default in browserslist to be in line with eslint and stylelint extendability.

[ai]

Since eslint and stylelint both come with a very similar extend functionallity but both without this security feature, i vote for disabling the feature per default in browserslist to be in line with eslint and stylelint extendability.

I do no trust open source community to use ESLint and Stylelint as examples as “you should not worry about it”.

This feature was added websites like CodePen or browserl.ist. Let’s took a browserl.ist as an example. As you can see developer forget to escape extends query. I do not think that it is a developer’s mistake. If we will fix it in this website, other developers will make the same mistake on a new website.

then i realized that does still not help in all cases because IDE implemented lint tools like eslint vscode plugin can still not be configured to use it.

You can set BROWSERSLIST_DANGEROUS_EXTEND on system-level in your .bashrc config.