chore: small fixes and version bumps

[r0b1n]

No description provided.

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
.github/workflows/BuildJobs.yml	Removed head.repo.full_name == 'mendix/web-widgets' guard from changelog-check condition
packages/pluggableWidgets/image-cropper-web/package.json	minimumMXVersion bumped from 10.21.0 to 11.12.0
pnpm-lock.yaml	ip-address transitive dependency bumped from 10.2.0 to 10.4.0

Skipped (out of scope): pnpm-lock.yaml (lockfile changes reviewed only for the ip-address bump context)

---

Findings

⚠️ Low — Changelog-check now runs on fork PRs

File: .github/workflows/BuildJobs.yml line 69
Note: The removed condition github.event.pull_request.head.repo.full_name == 'mendix/web-widgets' previously ensured the changelog step only ran on PRs from the main repo. Without it, the step will also run on fork PRs. Since it runs in the check job (which runs on pull_request from main), fork PRs generally have limited access to secrets, but the step itself (pnpm run -w check-changelogs) reads BASE_SHA/HEAD_SHA from the event — those are available to fork PRs. This is probably the intended change (e.g. to enforce changelog checks on community PRs too), but consider documenting the intent in a comment so reviewers don't re-add the guard in the future.

⚠️ Low — minimumMXVersion bump has no CHANGELOG entry

File: packages/pluggableWidgets/image-cropper-web/package.json line 20
Note: Raising minimumMXVersion from 10.21.0 to 11.12.0 is a breaking change for any user still on Mx 10.x. The current CHANGELOG only has the [1.0.0] initial release entry under [Unreleased] — there is no new entry recording this compatibility change. Consider adding a brief entry (e.g. under ### Changed: Raised minimum Mendix version to 11.12.0) so downstream consumers are informed. Run pnpm -w changelog to scaffold the entry.

---

Positives

• The ip-address bump from 10.2.0 → 10.4.0 addresses a known transitive vulnerability in express-rate-limit cleanly, with no manual override traces left in package.json.
• All action references in the workflow remain SHA-pinned with version comments — the edit preserves that convention.
• The condition change is minimal and surgical; it doesn't touch any surrounding logic.