chore(deps): bump the production-dependencies group across 1 directory with 11 updates

[dependabot]

Bumps the production-dependencies group with 11 updates in the / directory:

Package	From	To
@gravity-ui/uikit-themer	1.7.0	1.8.1
@inquirer/prompts	8.3.2	8.7.2
execa	9.6.0	9.6.1
highlight.js	11.11.1	11.12.0
js-yaml	4.1.0	4.3.2
katex	0.16.9	0.18.7
lodash	4.17.21	4.18.1
postcss	8.5.15	8.5.28
tapable	2.2.1	2.3.3
ts-dedent	2.2.0	2.3.0
yaml	2.9.0	2.9.1

Updates @gravity-ui/uikit-themer from 1.7.0 to 1.8.1

Release notes

Sourced from @​gravity-ui/uikit-themer's releases.

v1.8.1

1.8.1 (2026-07-16)

Bug Fixes

• DEFAULT_THEME: fix differences from the default theme in uikit (5e73bff)

v1.8.0

1.8.0 (2026-04-21)

Features

• add illustrations colors (fcd1607)
• add utility color refs support for illustration colors and illustration internal refs utils (36ac79d)
• integrate illustration colors into theme generation and parsing (8c431ab)

Bug Fixes

• json parser internal references (020074d)

Changelog

Sourced from @​gravity-ui/uikit-themer's changelog.

1.8.1 (2026-07-16)

Bug Fixes

• DEFAULT_THEME: fix differences from the default theme in uikit (5e73bff)

1.8.0 (2026-04-21)

Features

• add illustrations colors (fcd1607)
• add utility color refs support for illustration colors and illustration internal refs utils (36ac79d)
• integrate illustration colors into theme generation and parsing (8c431ab)

Bug Fixes

• json parser internal references (020074d)

Commits

• 0cfba78 Merge pull request #25 from gravity-ui/release-please--branches--main--compon...
• 9927f33 chore(main): release 1.8.1
• 220ab3b Merge pull request #24 from gravity-ui/fix-uikit-color-diff
• 5e73bff fix(DEFAULT_THEME): fix differences from the default theme in uikit
• 3c2c46d Merge pull request #21 from gravity-ui/release-please--branches--main--compon...
• 4998941 chore(main): release 1.8.0
• 13afb3d Merge pull request #19 from gravity-ui/feat/illustrations-colors
• 36ac79d feat: add utility color refs support for illustration colors and illustration...
• 020074d fix: json parser internal references
• bacc683 Merge pull request #20 from gravity-ui/feat/some-suggestions-to-illustration-...
• Additional commits viewable in compare view

Updates @inquirer/prompts from 8.3.2 to 8.7.2

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.7.2

What's new

• Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (@inquirer/core, #2255, closes #1816).
• confirm() now trims surrounding whitespace from answers before matching yes/no keywords (@inquirer/confirm, #2254).

Included

• @inquirer/checkbox@^5.2.5
• @inquirer/confirm@^6.3.2
• @inquirer/editor@^5.3.3
• @inquirer/expand@^5.1.5
• @inquirer/input@^5.1.6
• @inquirer/number@^4.2.3
• @inquirer/password@^5.2.2
• @inquirer/rawlist@^5.3.5
• @inquirer/search@^4.3.3
• @inquirer/select@^5.2.5

@​inquirer/prompts@​8.7.1

What's new

• All bundled prompts now pin @inquirer/type to an exact version in their published manifests. Since these type definitions leak into consumers' tsc runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (#2247, fixes #2244).

Included

• @inquirer/checkbox@^5.2.4
• @inquirer/confirm@^6.3.1
• @inquirer/editor@^5.3.2
• @inquirer/expand@^5.1.4
• @inquirer/input@^5.1.5
• @inquirer/number@^4.2.2
• @inquirer/password@^5.2.1
• @inquirer/rawlist@^5.3.4
• @inquirer/search@^4.3.2
• @inquirer/select@^5.2.4

@​inquirer/prompts@​8.7.0

What's new

• password gains the toggleMask option (ctrl+t to reveal the typed value).
• confirm now matches localized yes/no answers per-locale.
• Prettified prompt and theme types for better IDE display.
• Added inquirer-grouped-checkbox to the community prompts list (#2236).

Included

... (truncated)

Commits

• cbdb34b chore: Publish new release
• 8340d2d fix(@​inquirer/core): clear hook effects before settling prompts
• 2475e07 test(@​inquirer/core): cover hook cleanup error semantics
• 15cd8d3 fix(confirm): ignore surrounding whitespace in answers
• 9cb0da6 chore(deps): Bump github/codeql-action/analyze from 4.37.7 to 4.37.9
• 1c750bc chore(deps-dev): Bump the build group with 3 updates (#2251)
• 81f1525 chore(deps-dev): Bump @​types/node in the types group (#2252)
• 7c27f26 chore(deps-dev): Bump oxfmt in the formatting group (#2249)
• 6119088 chore(deps): Bump github/codeql-action/init from 4.37.7 to 4.37.9 (#2250)
• 0d167c0 chore(deps-dev): Bump the linting group with 4 updates (#2248)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​inquirer/prompts since your current version.

Updates execa from 9.6.0 to 9.6.1

Release notes

Sourced from execa's releases.

v9.6.1

• Fix VerboseOption type not being properly exported (#1215) 7891c39

---

sindresorhus/execa@v9.6.0...v9.6.1

Commits

• 84e1f36 9.6.1
• 7891c39 Fix VerboseOption type not being properly exported (#1215)
• 103095f Meta tweaks
• 23ec6f0 Fix CI tests related to .kill(0) (#1212)
• 9a2cb79 Meta tweaks
• e7cafeb [docs] TTY control is lost only on the FD that uses mixed inherit. (#1209)
• 5587ae1 Fix CI tests (#1207)
• 3e8fa32 [docs] A process is not a TTY usually, just connected to one. (#1208)
• c468672 [docs] Transforms: Summary: Fix example command and output. (#1206)
• See full diff in compare view

Updates highlight.js from 11.11.1 to 11.12.0

Release notes

Sourced from highlight.js's releases.

v11.12.0 - Summer, hot and rainy.

Parser Engine:

• fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

• add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
• added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
• added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
• added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
• added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
• added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
• added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
• added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
• added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
• added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
• added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
• added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
• added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
• referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

• fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
• fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
• fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
• fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
• enh(cmake) add block and endblock keywords [Anonymous Maarten][]
• fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
• fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
• fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
• enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
• enh(css) add corner-shape properties [Hama Tanveer][]
• enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
• enh(dart) add highlighting for class and function names [guuido][]
• enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
• enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
• enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
• enh(gherkin) update keyword list [Hirse][]
• enh(gherkin) variables can't contain whitespace [Hirse][]
• enh(gherkin) docstrings can use backticks [Hirse][]
• enh(go) recognize binary integer literals [spokodev][]
• enh(groovy) support underscores in numeric literals [greymoth][]
• fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
• enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
• enh(javascript) add self to built-in variables [Dsaquel][]
• enh(kotlin) add ktm and ktx aliases [DarkMatter-999][]
• fix(leaf) fix bug in Leaf keyword highlighting [Francesco Paolo Severino][]
• fix(lisp) preserve highlighting after quoted multiplication expressions [arturict][]

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 11.12.0

Parser Engine:

• fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

• add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
• added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
• added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
• added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
• added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
• added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
• added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
• added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
• added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
• added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
• added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
• added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
• added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
• referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

• fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
• fix(c) do not highlight C++ std types as built-ins, issue #4103 [Arron Zou][]
• fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
• fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
• fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
• enh(cmake) add block and endblock keywords [Anonymous Maarten][]
• fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
• fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
• fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
• enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
• enh(css) add corner-shape properties [Hama Tanveer][]
• enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
• enh(dart) add highlighting for class and function names [guuido][]
• enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
• enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
• enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
• enh(gherkin) update keyword list [Hirse][]
• enh(gherkin) variables can't contain whitespace [Hirse][]
• enh(gherkin) docstrings can use backticks [Hirse][]
• enh(go) recognize binary integer literals [spokodev][]
• enh(groovy) support underscores in numeric literals [greymoth][]
• fix(haml) recognize implicit div tag lines starting with .class or #id, issue #3783 [pikammmmm][]
• fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
• enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
• enh(javascript) add self to built-in variables [Dsaquel][]

... (truncated)

Commits

• f7f7d38 (release) release v11.12.0
• c4c4728 (docs) FreeDesktop + Kotlin aliases; note extra language override
• 9142292 bump version to 11.12.0
• 03d1e7e (chore) rebuild CHANGES.md for 11.12.0
• ca6bb8e enh(sqf) update to A3 v2.22 (#4460)
• 1414c96 fix: use Trusted Publishers in publishing pipeline (#4427)
• 2a9ad7d fix(markdown) don't treat a thematic break as the start of bold text (#4485)
• 375f3f4 build(deps-dev): bump @​rollup/plugin-commonjs from 28.0.1 to 29.0.3 (#4481)
• 2ce1706 build(deps-dev): bump del from 8.0.0 to 8.0.1 (#4484)
• 72084b5 fix(ruby): don't treat scope resolution :: as symbols (#4463)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for highlight.js since your current version.

Updates js-yaml from 4.1.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.

... (truncated)

Commits

• 79ca68d 4.3.2 released
• d90b661 Backport merge limits from v5.4.1
• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• Additional commits viewable in compare view

Updates katex from 0.16.9 to 0.18.7

Release notes

Sourced from katex's releases.

v0.18.7

0.18.7 (2026-09-06)

Features

• add \reflectbox and \mapsfrom support (#4262) (ab509fd)

v0.18.6

0.18.6 (2026-09-05)

Bug Fixes

• array: preserve tags on empty final rows (#4277) (02d552c)

v0.18.5

0.18.5 (2026-08-31)

Bug Fixes

• char: accept U+10FFFF (#4265) (6805538), closes #2549

v0.18.4

0.18.4 (2026-08-10)

Bug Fixes

• environment: report invalid environment names as ParseError (#4256) (e507f75), closes #3760 #3760

v0.18.3

0.18.3 (2026-08-09)

Bug Fixes

• allow braced arguments for delimsizing (#4255) (1c973ae)

v0.18.2

0.18.2 (2026-08-08)

Bug Fixes

• prevent prototype pollution in settings (#4260) (0adf7e7)

v0.18.1

0.18.1 (2026-07-19)

... (truncated)

Changelog

Sourced from katex's changelog.

0.18.7 (2026-09-06)

Features

• add \reflectbox and \mapsfrom support (#4262) (ab509fd)

0.18.6 (2026-09-05)

Bug Fixes

• array: preserve tags on empty final rows (#4277) (02d552c)

0.18.5 (2026-08-31)

Bug Fixes

• char: accept U+10FFFF (#4265) (6805538), closes #2549

0.18.4 (2026-08-10)

Bug Fixes

• environment: report invalid environment names as ParseError (#4256) (e507f75), closes #3760 #3760

0.18.3 (2026-08-09)

Bug Fixes

• allow braced arguments for delimsizing (#4255) (1c973ae)

0.18.2 (2026-08-08)

Bug Fixes

• prevent prototype pollution in settings (#4260) (0adf7e7)

0.18.1 (2026-07-19)

Bug Fixes

• htmlData: allow escaped commas in \htmlData (#4236) (87a2b30), closes #4204 #4218

0.18.0 (2026-07-17)

... (truncated)

Commits

• cd5ec4f chore(release): 0.18.7 [ci skip]
• ab509fd feat: add \reflectbox and \mapsfrom support (#4262)
• 9eb45b7 chore(release): 0.18.6 [ci skip]
• 02d552c fix(array): preserve tags on empty final rows (#4277)
• 49904aa chore(deps): update dependency browserslist to v4.28.7 [security] (#4280)
• 2d2a177 chore(deps): bump github/codeql-action from 4.37.8 to 4.37.9 (#4275)
• 7f46076 chore(release): 0.18.5 [ci skip]
• 6805538 fix(char): accept U+10FFFF (#4265)
• 0df23bb chore(deps): bump github/codeql-action from 4.37.7 to 4.37.8 (#4273)
• bd78fad chore(deps): update dependency commander to v15 (#4271)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates postcss from 8.5.15 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

... (truncated)

Commits

• e544bff Release 8.5.28 version
• f8fc252 Typo
• 5039fd7 Add missed release notes
• ae40ca4 Release 8.5.27 version
• 62b1626 Fix linter
• 1dba938 Update dependencies
• 3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
• 6d23bc3 Fix link
• 508e997 Add GitHub Sponsors link
• e993739 Add CodeRabbit sponsor (#2145)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates tapable from 2.2.1 to 2.3.3

Release notes

Sourced from tapable's releases.

v2.3.3

Patch Changes

• Improved performance in many places. (by @​alexander-akait in #217)

v2.3.2

Patch Changes

• Revert ignore invalid before values. (by @​alexander-akait in #211)

v2.3.1

Patch Changes

• Ignore invalid before values. (by @​alexander-akait in #208)

• Trim the name option when options is an object. (by @​alexander-akait in #208)

v2.3.0

Features

• [TYPES] Added TypedHookMap type.

v2.2.3

Fixes

• Async hook catch an error when reject a falsy value
• [typescript] Support to pass return type for waterfall hooks

v2.2.2

Developer Experience

• add interceptors type to hook class

Changelog

Sourced from tapable's changelog.

2.3.3

Patch Changes

• Improved performance in many places. (by @​alexander-akait in #217)

2.3.2

Patch Changes

• Revert ignore invalid before values. (by @​alexander-akait in #211)

2.3.1

Patch Changes

• Ignore invalid before values. (by @​alexander-akait in #208)

• Trim the name option when options is an object. (by @​alexander-akait in #208)

Commits

• 4296012 chore(release): new release (#222)
• 780b3c0 fix: preserve custom tap options dropped by _tap fast path (#227)
• 5da5021 chore: test refactor + change changelog entry (#226)
• 2ba184c fix(perf): more perf
• 9e9ae4d fix(perf): improve (#224)
• 4e24645 test: improve code coverage with additional test cases
• 2a304ae test: add tinybench benchmarks and CodSpeed CI (#217)
• 0ec6d24 docs: expand API reference to address issue #49 (#221)
• edb1d12 docs: describe each hook class in the README and add small examples
• a2b0d37 chore(deps-dev): bump prettier in the dependencies group (#219)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tapable since your current version.

Updates ts-dedent from 2.2.0 to 2.3.0

Release notes

Sourced from ts-dedent's releases.

v2.3.0

• Documented the dedent algorithm in the readme with a step-by-step "How it works" section (closes #39)
• Added an automated release workflow: npm publish with provenance via OIDC trusted publishing, GitHub release creation, and automatic version/HISTORY maintenance
• CI now verifies the packaged tarball (CommonJS require, ESM import, and TypeScript type resolution) on every maintained Node version (22/24/26) across Linux, macOS, and Windows
• Fixed package exports to use per-condition types so TypeScript resolves the correct declarations for both ESM (import) and CommonJS (require) consumers
• Declared the ESM build as type: module explicitly and removed the redundant .npmignore
• Updated the CI matrix to currently-maintained Node and OS versions (dropped EOL entries)

v2.3.0-beta.3

• Added an automated release workflow: npm publish with provenance via OIDC trusted publishing, GitHub release creation, and automatic version/HISTORY maintenance
• CI now verifies the packaged tarball (CommonJS require, ESM import, and TypeScript type resolution) on every maintained...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependabot. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.