Bump js-yaml, cssnano, gulp-postcss and gulp-svg-sprite #91

dependabot · 2025-11-16T17:15:45Z

Bumps js-yaml to 4.1.1 and updates ancestor dependencies js-yaml, cssnano, gulp-postcss and gulp-svg-sprite. These dependencies need to be updated together.

Updates js-yaml from 3.13.1 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

Added replacer option (similar to option in JSON.stringify), #339.

Custom Tag can now handle all tags or multiple tags with the same prefix, #385.

Fixed

... (truncated)

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
2cef47b 4.1.0 released
810b149 dist rebuild
2b5620e Export built-in types, type override now preserves order
Additional commits viewable in compare view

Updates cssnano from 4.1.10 to 7.1.2

Release notes

Sourced from cssnano's releases.

v7.1.2

What's Changed

fix: enhanced recognition of css comments by @Nirvana-Jie in cssnano/cssnano#1730

chore: use npm trusted publishing by @ludofischer in cssnano/cssnano#1731

fix: update browserslist by @ludofischer in cssnano/cssnano#1733

Full Changelog: https://github.com/cssnano/cssnano/compare/[email protected]@7.1.2

v71.1.1

Bug Fixes

fix(convert-values): exclude linear() from stripping % from value 0 by @cernymatej in cssnano/cssnano#1720

Full Changelog: https://github.com/cssnano/cssnano/compare/[email protected]@7.1.1

[email protected]

Changes

Update to SVGO 4.0

Update browserslist

[email protected]

What's Changed

fix: update browserslist by @ludofischer in cssnano/cssnano#1675

fix: update postcss peer dependency to version without vulnerabilities by @ludofischer in cssnano/cssnano#1676

fix: update TypeScript declarations by @ludofischer in cssnano/cssnano#1685

perf: load default preset in startup by @43081j in cssnano/cssnano#1691

Add support for selector order preservation to postcss-minify-selectors by @ezzak in cssnano/cssnano#1688

fix(postcss-convert-values): preserve percent sign in percentage values in at-rules with double quotes by @aramikuto in cssnano/cssnano#1695

Full Changelog: https://github.com/cssnano/cssnano/compare/[email protected]@7.0.7

v7.0.6

What's Changed

Update postcss-calc and selector-parser by @ludofischer in cssnano/cssnano#1663

fix(postcss-convert-values): convert 0ms to 0s by @btea in cssnano/cssnano#1665

Full Changelog: https://github.com/cssnano/cssnano/compare/[email protected]@7.0.6

v7.0.5

Bug Fixes

Fix layer rule deduping cssnano/cssnano#1656

v7.0.4

... (truncated)

Commits

c847b6b Publish cssnano 7.1.2
72dd9c9 fix: update browserslist
19849ba chore: update dev dependencies
ad02c7c chore: use npm trusted publishing
f31273c fix: enhanced recognition of css comments (#1730)
bd3b251 chore: update GitHub actions
bba3b5f chore: update development deps
53c4033 test: switch to built-in Node.js test coverage
ff17fd3 chore: update development dependencies
c9e493c chore: update pnpm
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for cssnano since your current version.

Updates gulp-postcss from 8.0.0 to 10.0.0

Release notes

Sourced from gulp-postcss's releases.

10.0.0

Same changes as https://github.com/postcss/gulp-postcss/releases/tag/9.1.0, published with the major version bump because of a breaking change.

9.1.0 (deprecated)

Deprecated, republished as 10.0.0 to follow semver, because of the breaking change to drop support for node <18

Bump postcss-load-config to ^5.0.0

Ensure options are passed to plugins when using postcss.config.js #170

Update deps

Drop support for node <18

Add flake.nix for local dev with nix develop

9.0.1

Bump postcss-load-config to ^3.0.0

9.0.0

Bump PostCSS to 8.0

Drop Node 6 support

PostCSS is now a peer dependency

Commits

46533ec Bump to 10.0.0
77ed79a Merge pull request #187 from postcss/update-deps
687f29f Bump to 9.1.0
c21fca9 Merge pull request #170 from JohnAlbin/pass-options-to-plugins
bd9d4c0 Merge pull request #186 from postcss/bump-postcss-load-config
0f15414 Bump postcss-load-config
83dcfcd Merge branch 'main' into pass-options-to-plugins
70dfabe Release 9.0.1
5d3bf7a Merge pull request #176 from postcss/switch-to-github-workflows
22e8c3a Switch to github workflow for testing
Additional commits viewable in compare view

Updates gulp-svg-sprite from 1.5.0 to 2.0.3

Release notes

Sourced from gulp-svg-sprite's releases.

v2.0.3

What's Changed

CI: add macOS too

CI: increase mocha timeout to 10000

Update README.md

Move mocha config to .mocharc.json

Fix package.json properties after the repo move

Update xo settings

Full Changelog: svg-sprite/gulp-svg-sprite@v2.0.2...v2.0.3

v2.0.2

What's Changed

Bump decode-uri-component from 0.2.0 to 0.2.2 by @dependabot in svg-sprite/gulp-svg-sprite#134

Bump json5 from 1.0.1 to 1.0.2 by @dependabot in svg-sprite/gulp-svg-sprite#137

Fix improperly configured error showing by @Kreeg in svg-sprite/gulp-svg-sprite#136

Updated dependencies by @Kreeg in svg-sprite/gulp-svg-sprite#135

Full Changelog: svg-sprite/gulp-svg-sprite@v2.0.1...v2.0.2

v2.0.1

Updated dependencies

v2.0.0

What's Changed

Refactored code

Dropped support for Node.js < 12

Updated all dependencies including svg-sprite to v2.0.0

Reduced dependencies

Switched to GitHub Actions

Switched to xo for linting

Full Changelog: svg-sprite/gulp-svg-sprite@v1.5.0...v2.0.0

Commits

dc43285 2.0.3
19a9803 Update xo settings
d545154 Fix package.json properties after the repo move
0d0007f Move mocha config to .mocharc.json
573f14c Update README.md
067b532 Increase mocha timeout to 10000
91c238a CI: add macOS too
fe828b0 2.0.2
16900f5 Regenerate package-lock.json
4edfc14 Specify lockfile-version=2 for older npm compatibility
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by xhmikosr, a new releaser for gulp-svg-sprite since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.1.1 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [cssnano](https://github.com/cssnano/cssnano), [gulp-postcss](https://github.com/postcss/gulp-postcss) and [gulp-svg-sprite](https://github.com/svg-sprite/gulp-svg-sprite). These dependencies need to be updated together. Updates `js-yaml` from 3.13.1 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.13.1...4.1.1) Updates `cssnano` from 4.1.10 to 7.1.2 - [Release notes](https://github.com/cssnano/cssnano/releases) - [Commits](https://github.com/cssnano/cssnano/compare/[email protected]) Updates `gulp-postcss` from 8.0.0 to 10.0.0 - [Release notes](https://github.com/postcss/gulp-postcss/releases) - [Commits](postcss/gulp-postcss@8.0.0...10.0.0) Updates `gulp-svg-sprite` from 1.5.0 to 2.0.3 - [Release notes](https://github.com/svg-sprite/gulp-svg-sprite/releases) - [Changelog](https://github.com/svg-sprite/gulp-svg-sprite/blob/main/CHANGELOG.md) - [Commits](svg-sprite/gulp-svg-sprite@v1.5.0...v2.0.3) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect - dependency-name: cssnano dependency-version: 7.1.2 dependency-type: direct:development - dependency-name: gulp-postcss dependency-version: 10.0.0 dependency-type: direct:development - dependency-name: gulp-svg-sprite dependency-version: 2.0.3 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>

coderabbitai · 2025-11-16T17:15:59Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 16, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump js-yaml, cssnano, gulp-postcss and gulp-svg-sprite #91

Bump js-yaml, cssnano, gulp-postcss and gulp-svg-sprite #91

Uh oh!

dependabot bot commented on behalf of github Nov 16, 2025

Uh oh!

coderabbitai bot commented Nov 16, 2025

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump js-yaml, cssnano, gulp-postcss and gulp-svg-sprite #91

Are you sure you want to change the base?

Bump js-yaml, cssnano, gulp-postcss and gulp-svg-sprite #91

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 16, 2025

[4.1.1] - 2025-11-12

Security

[4.1.0] - 2021-04-15

Added

Changed

[4.0.0] - 2021-01-03

Changed

Added

Fixed

v7.1.2

What's Changed

v71.1.1

Bug Fixes

[email protected]

Changes

[email protected]

What's Changed

v7.0.6

What's Changed

v7.0.5

Bug Fixes

v7.0.4

10.0.0

9.1.0 (deprecated)

9.0.1

9.0.0

v2.0.3

What's Changed

v2.0.2

What's Changed

v2.0.1

v2.0.0

What's Changed

Uh oh!

coderabbitai bot commented Nov 16, 2025

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant