Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 11 updates - #2213

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-dependencies-dcedc81236
Open

chore(deps): bump the production-dependencies group across 1 directory with 11 updates#2213
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-dependencies-dcedc81236

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 11 updates in the / directory:

Package From To
@diplodoc/ajv 0.4.2 0.4.4
@gravity-ui/uikit-themer 1.7.0 1.8.1
@inquirer/prompts 8.3.2 8.6.0
execa 9.6.0 9.6.1
highlight.js 11.11.1 11.12.0
js-yaml 4.1.0 4.3.1
katex 0.16.9 0.18.4
lodash 4.17.21 4.18.1
postcss 8.5.15 8.5.26
tapable 2.2.1 2.3.3
ts-dedent 2.2.0 2.3.0

Updates @diplodoc/ajv from 0.4.2 to 0.4.4

Release notes

Sourced from @​diplodoc/ajv's releases.

v0.4.4

0.4.4 (2026-08-13)

Bug Fixes

v0.4.3

0.4.3 (2026-08-10)

Bug Fixes

Changelog

Sourced from @​diplodoc/ajv's changelog.

0.4.4 (2026-08-13)

Bug Fixes

0.4.3 (2026-08-10)

Bug Fixes

Commits

Updates @gravity-ui/uikit-themer from 1.7.0 to 1.8.1

Release notes

Sourced from @​gravity-ui/uikit-themer's releases.

v1.8.1

1.8.1 (2026-07-16)

Bug Fixes

  • DEFAULT_THEME: fix differences from the default theme in uikit (5e73bff)

v1.8.0

1.8.0 (2026-04-21)

Features

  • add illustrations colors (fcd1607)
  • add utility color refs support for illustration colors and illustration internal refs utils (36ac79d)
  • integrate illustration colors into theme generation and parsing (8c431ab)

Bug Fixes

  • json parser internal references (020074d)
Changelog

Sourced from @​gravity-ui/uikit-themer's changelog.

1.8.1 (2026-07-16)

Bug Fixes

  • DEFAULT_THEME: fix differences from the default theme in uikit (5e73bff)

1.8.0 (2026-04-21)

Features

  • add illustrations colors (fcd1607)
  • add utility color refs support for illustration colors and illustration internal refs utils (36ac79d)
  • integrate illustration colors into theme generation and parsing (8c431ab)

Bug Fixes

  • json parser internal references (020074d)
Commits
  • 0cfba78 Merge pull request #25 from gravity-ui/release-please--branches--main--compon...
  • 9927f33 chore(main): release 1.8.1
  • 220ab3b Merge pull request #24 from gravity-ui/fix-uikit-color-diff
  • 5e73bff fix(DEFAULT_THEME): fix differences from the default theme in uikit
  • 3c2c46d Merge pull request #21 from gravity-ui/release-please--branches--main--compon...
  • 4998941 chore(main): release 1.8.0
  • 13afb3d Merge pull request #19 from gravity-ui/feat/illustrations-colors
  • 36ac79d feat: add utility color refs support for illustration colors and illustration...
  • 020074d fix: json parser internal references
  • bacc683 Merge pull request #20 from gravity-ui/feat/some-suggestions-to-illustration-...
  • Additional commits viewable in compare view

Updates @inquirer/prompts from 8.3.2 to 8.6.0

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.6.0

The all-in-one prompts package, re-exporting every individual prompt at its latest version.

Highlights

This release rides on @inquirer/core@12.0.0, which makes the useState setter accept a reducer/updater function. It also brings a new initialValue option to search, plus fixes for number, confirm, and editor.

What's new

  • @inquirer/search — new initialValue?: string option to pre-fill the search input (#2205)

What's fixed

  • @inquirer/number — avoid floating-point step errors; accept explicit undefined as default (#2166, #2182)
  • @inquirer/confirm — accept explicit undefined as default (#2182)
  • @inquirer/editor — accept explicit undefined as default (#2182)

Included prompts

  • @inquirer/checkbox@5.2.2
  • @inquirer/confirm@6.2.0
  • @inquirer/editor@5.3.0
  • @inquirer/expand@5.1.2
  • @inquirer/input@5.1.3
  • @inquirer/number@4.2.0
  • @inquirer/password@5.1.2
  • @inquirer/rawlist@5.3.2
  • @inquirer/search@4.3.0
  • @inquirer/select@5.2.2

Note: This release depends on @inquirer/core@^12.0.0, which contains a breaking change to the useState setter type (it now accepts a reducer function). See the @inquirer/core@12.0.0 release notes for details.

@​inquirer/prompts@​8.5.2

  • Fix security warnings in external-editor

@​inquirer/prompts@​8.5.1

  • Rolled back mute-stream dependency from v4 to v3 to undo breaking compatible engines.
  • Added tooling to prevent regression of the above in the future. This surfaced our min engines already enforced a higher limit, so adjusted the explicit limits to match the current state.

@​inquirer/prompts@​8.5.0

  • Feat: Read env variable INQUIRER_KEYBINDINGS to enable vim or emacs keybindings; making this a user preference instead of a library author preference. One caveat is doing so disable the search feature in the select prompt. Syntax: INQUIRER_KEYBINDINGS=vim,emacs.
  • Fix: Line wraps would sometime cause the cursor to be mispositioned relative to the input.
  • Chore: Bump dependencies.

@​inquirer/prompts@​8.4.3

  • Fix: Windows rendering bug
  • Fix: Preserve exact literal types in choices array (Typescript only)
  • Fix: Allow input default value to be of type undefined (Typescript only)
  • Bump dependencies

... (truncated)

Commits
  • 9997067 fix(release): serialize staging with --concurrency 1
  • 2073546 fix(release): disable auto-install hook event in postpack restore
  • 7f00eb7 fix(release): bypass auto-install hook in postpack restore
  • 5384fa6 chore(release): add workflow_dispatch trigger to publish workflow
  • d11785f fix(release): warm turbo cache before staging in publish job
  • 36d4928 chore: Publish new release
  • 15dfc54 chore(deps): Bump globby from 16.2.2 to 16.2.3 (#2234)
  • 6678f5f chore(deps-dev): Bump oxfmt in the formatting group (#2233)
  • e57dafa chore: secure release pipeline with npm Trusted Publishing
  • 2d677bb fix: don't restore package.json in postpack before publish (#2231)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​inquirer/prompts since your current version.


Updates execa from 9.6.0 to 9.6.1

Release notes

Sourced from execa's releases.

v9.6.1

  • Fix VerboseOption type not being properly exported (#1215) 7891c39

sindresorhus/execa@v9.6.0...v9.6.1

Commits

Updates highlight.js from 11.11.1 to 11.12.0

Release notes

Sourced from highlight.js's releases.

v11.12.0 - Summer, hot and rainy.

Parser Engine:

  • fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

  • add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
  • added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
  • added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
  • added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
  • added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
  • added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
  • added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
  • added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
  • added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
  • added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
  • added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
  • added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
  • added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
  • referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

  • fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
  • fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
  • fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
  • fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
  • enh(cmake) add block and endblock keywords [Anonymous Maarten][]
  • fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
  • fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
  • fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
  • enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
  • enh(css) add corner-shape properties [Hama Tanveer][]
  • enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
  • enh(dart) add highlighting for class and function names [guuido][]
  • enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
  • enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
  • enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
  • enh(gherkin) update keyword list [Hirse][]
  • enh(gherkin) variables can't contain whitespace [Hirse][]
  • enh(gherkin) docstrings can use backticks [Hirse][]
  • enh(go) recognize binary integer literals [spokodev][]
  • enh(groovy) support underscores in numeric literals [greymoth][]
  • fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
  • enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
  • enh(javascript) add self to built-in variables [Dsaquel][]
  • enh(kotlin) add ktm and ktx aliases [DarkMatter-999][]
  • fix(leaf) fix bug in Leaf keyword highlighting [Francesco Paolo Severino][]
  • fix(lisp) preserve highlighting after quoted multiplication expressions [arturict][]

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 11.12.0

Parser Engine:

  • fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

  • add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
  • added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
  • added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
  • added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
  • added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
  • added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
  • added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
  • added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
  • added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
  • added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
  • added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
  • added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
  • added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
  • referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

  • fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
  • fix(c) do not highlight C++ std types as built-ins, issue #4103 [Arron Zou][]
  • fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
  • fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
  • fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
  • enh(cmake) add block and endblock keywords [Anonymous Maarten][]
  • fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
  • fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
  • fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
  • enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
  • enh(css) add corner-shape properties [Hama Tanveer][]
  • enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
  • enh(dart) add highlighting for class and function names [guuido][]
  • enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
  • enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
  • enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
  • enh(gherkin) update keyword list [Hirse][]
  • enh(gherkin) variables can't contain whitespace [Hirse][]
  • enh(gherkin) docstrings can use backticks [Hirse][]
  • enh(go) recognize binary integer literals [spokodev][]
  • enh(groovy) support underscores in numeric literals [greymoth][]
  • fix(haml) recognize implicit div tag lines starting with .class or #id, issue #3783 [pikammmmm][]
  • fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
  • enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
  • enh(javascript) add self to built-in variables [Dsaquel][]

... (truncated)

Commits
  • f7f7d38 (release) release v11.12.0
  • c4c4728 (docs) FreeDesktop + Kotlin aliases; note extra language override
  • 9142292 bump version to 11.12.0
  • 03d1e7e (chore) rebuild CHANGES.md for 11.12.0
  • ca6bb8e enh(sqf) update to A3 v2.22 (#4460)
  • 1414c96 fix: use Trusted Publishers in publishing pipeline (#4427)
  • 2a9ad7d fix(markdown) don't treat a thematic break as the start of bold text (#4485)
  • 375f3f4 build(deps-dev): bump @​rollup/plugin-commonjs from 28.0.1 to 29.0.3 (#4481)
  • 2ce1706 build(deps-dev): bump del from 8.0.0 to 8.0.1 (#4484)
  • 72084b5 fix(ruby): don't treat scope resolution :: as symbols (#4463)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for highlight.js since your current version.


Updates js-yaml from 4.1.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • Additional commits viewable in compare view

Updates katex from 0.16.9 to 0.18.4

Release notes

Sourced from katex's releases.

v0.18.4

0.18.4 (2026-08-10)

Bug Fixes

v0.18.3

0.18.3 (2026-08-09)

Bug Fixes

v0.18.2

0.18.2 (2026-08-08)

Bug Fixes

v0.18.1

0.18.1 (2026-07-19)

Bug Fixes

v0.18.0

0.18.0 (2026-07-17)

Features

BREAKING CHANGES

  • users who apply custom styles or have allowlists targeting KaTeX's internal classes must update their selectors.

v0.17.0

0.17.0 (2026-05-22)

Performance Improvements

... (truncated)

Changelog

Sourced from katex's changelog.

0.18.4 (2026-08-10)

Bug Fixes

0.18.3 (2026-08-09)

Bug Fixes

0.18.2 (2026-08-08)

Bug Fixes

0.18.1 (2026-07-19)

Bug Fixes

0.18.0 (2026-07-17)

Features

BREAKING CHANGES

  • users who apply custom styles or have allowlists targeting KaTeX's internal classes must update their selectors.

0.17.0 (2026-05-22)

Performance Improvements

  • simplify defineFunction to avoid destructuring, improve typing (#4222) (fb604e6)

BREAKING CHANGES

... (truncated)

Commits
  • 49dc3d9 chore(release): 0.18.4 [ci skip]
  • e507f75 fix(environment): report invalid environment names as ParseError (#4256)
  • f0f46a8 chore(release): 0.18.3 [ci skip]
  • 1c973ae fix: allow braced arguments for delimsizing (#4255)
  • a11ce72 docs: update migration guide (#4248)
  • 95322e1 docs: add Deno section (#4254)
  • dd88e46 chore(deps): update dependency js-yaml to v4.3.1 [security] (#4263)
  • 93c362b chore(release): 0.18.2 [ci skip]
  • 0adf7e7 fix: prevent prototype pollution in settings (#4260)
  • 5a5bf20 chore(deps): update dependency postcss to v8.5.23 [security] (#4259)
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates postcss from 8.5.15 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

Changelog

Sourced from postcss's changelog.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates tapable from 2.2.1 to 2.3.3

Release notes

Sourced from tapable's releases.

v2.3.3

Patch Changes

v2.3.2

Patch Changes

v2.3.1

Patch Changes

v2.3.0

Features

  • [TYPES] Added TypedHookMap type.

v2.2.3

Fixes

  • Async hook catch an error when reject a falsy value
  • [typescript] Support to pass return type for waterfall hooks

v2.2.2

Developer Experience

  • add interceptors type to hook class
Changelog

Sourced from tapable's changelog.

2.3.3

Patch Changes

2.3.2

Patch Changes

2.3.1

Patch Changes

Commits
  • 4296012 chore(release): new release (#222)
  • 780b3c0 fix: preserve custom tap options dropped by _tap fast path (#227)
  • 5da5021 chore: test refactor + change changelog entry (#226)
  • 2ba184c fix(perf): more perf
  • 9e9ae4d fix(perf): improve (#224)
  • 4e24645 test: improve code coverage with additional test cases
  • 2a304ae test: add tinybench benchmarks and CodSpeed CI (#217)

@dependabot
dependabot Bot requested a review from diplodoc-bot as a code owner August 20, 2026 14:06
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 20, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 20, 2026 14:06
@dependabot @github

dependabot Bot commented on behalf of github Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependabot. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot removed the request for review from a team August 20, 2026 14:06
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 20, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-dcedc81236 branch 10 times, most recently from e085147 to 5a1ae6f Compare August 27, 2026 11:08
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-dcedc81236 branch 2 times, most recently from f04b226 to de4378d Compare August 27, 2026 14:47
@dependabot
chore(deps): bump the production-dependencies group across 1 director…
9143e05 
…y with 11 updates

Bumps the production-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@diplodoc/ajv](https://github.com/diplodoc-platform/ajv) | `0.4.2` | `0.4.4` |
| [@gravity-ui/uikit-themer](https://github.com/gravity-ui/uikit-themer) | `1.7.0` | `1.8.1` |
| [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js) | `8.3.2` | `8.6.0` |
| [execa](https://github.com/sindresorhus/execa) | `9.6.0` | `9.6.1` |
| [highlight.js](https://github.com/highlightjs/highlight.js) | `11.11.1` | `11.12.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.1` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.16.9` | `0.18.4` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.26` |
| [tapable](https://github.com/webpack/tapable) | `2.2.1` | `2.3.3` |
| [ts-dedent](https://github.com/tamino-martinius/node-ts-dedent) | `2.2.0` | `2.3.0` |



Updates `@diplodoc/ajv` from 0.4.2 to 0.4.4
- [Release notes](https://github.com/diplodoc-platform/ajv/releases)
- [Changelog](https://github.com/diplodoc-platform/ajv/blob/master/CHANGELOG.md)
- [Commits](diplodoc-platform/ajv@v0.4.2...v0.4.4)

Updates `@gravity-ui/uikit-themer` from 1.7.0 to 1.8.1
- [Release notes](https://github.com/gravity-ui/uikit-themer/releases)
- [Changelog](https://github.com/gravity-ui/uikit-themer/blob/main/CHANGELOG.md)
- [Commits](gravity-ui/uikit-themer@v1.7.0...v1.8.1)

Updates `@inquirer/prompts` from 8.3.2 to 8.6.0
- [Release notes](https://github.com/SBoudrias/Inquirer.js/releases)
- [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/prompts@8.3.2...@inquirer/prompts@8.6.0)

Updates `execa` from 9.6.0 to 9.6.1
- [Release notes](https://github.com/sindresorhus/execa/releases)
- [Commits](sindresorhus/execa@v9.6.0...v9.6.1)

Updates `highlight.js` from 11.11.1 to 11.12.0
- [Release notes](https://github.com/highlightjs/highlight.js/releases)
- [Changelog](https://github.com/highlightjs/highlight.js/blob/main/CHANGES.md)
- [Commits](highlightjs/highlight.js@11.11.1...11.12.0)

Updates `js-yaml` from 4.1.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.3.1)

Updates `katex` from 0.16.9 to 0.18.4
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.16.9...v0.18.4)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `postcss` from 8.5.15 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.26)

Updates `tapable` from 2.2.1 to 2.3.3
- [Release notes](https://github.com/webpack/tapable/releases)
- [Changelog](https://github.com/webpack/tapable/blob/main/CHANGELOG.md)
- [Commits](webpack/tapable@v2.2.1...v2.3.3)

Updates `ts-dedent` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/tamino-martinius/node-ts-dedent/releases)
- [Changelog](https://github.com/tamino-martinius/node-ts-dedent/blob/master/HISTORY.md)
- [Commits](https://github.com/tamino-martinius/node-ts-dedent/commits/v2.3.0)

---
updated-dependencies:
- dependency-name: "@diplodoc/ajv"
  dependency-version: 0.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@gravity-ui/uikit-themer"
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@inquirer/prompts"
  dependency-version: 8.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: execa
  dependency-version: 9.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: highlight.js
  dependency-version: 11.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: katex
  dependency-version: 0.18.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: tapable
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ts-dedent
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-dcedc81236 branch from de4378d to 9143e05 Compare August 28, 2026 08:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@diplodoc-bot diplodoc-bot Awaiting requested review from diplodoc-bot diplodoc-bot is a code owner
@kadymov kadymov Awaiting requested review from kadymov kadymov is a code owner automatically assigned from diplodoc-platform/team
@martyanovandrey martyanovandrey Awaiting requested review from martyanovandrey martyanovandrey is a code owner automatically assigned from diplodoc-platform/team

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants