Skip to content

Bump js-yaml, grunt, grunt-contrib-clean, grunt-contrib-compress, grunt-contrib-copy and grunt-contrib-cssmin #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bump js-yaml, grunt, grunt-contrib-clean, grunt-contrib-compress, grunt-contrib-copy and grunt-contrib-cssmin #72

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 18, 2025

Bumps js-yaml to 3.14.2 and updates ancestor dependencies js-yaml, grunt, grunt-contrib-clean, grunt-contrib-compress, grunt-contrib-copy and grunt-contrib-cssmin. These dependencies need to be updated together.

Updates js-yaml from 2.0.5 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

  • Types are now exported as yaml.types.XXX.
  • Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

  • Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

  • Check migration guide to see details for all breaking changes.
  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
  • Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
  • !!binary now always mapped to Uint8Array on load.
  • Reduced nesting of /lib folder.
  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
  • Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
  • Code snippet created in exceptions now contains multiple lines with line numbers.
  • dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
  • dump() with skipInvalid=true now serializes invalid items in collections as null.
  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

  • Added .mjs (es modules) support.
  • Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
  • Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

Updates grunt from 0.4.5 to 1.6.1

Release notes

Sourced from grunt's releases.

v1.6.1

  • Changelog updates 72f6f03
  • Merge pull request #1755 from gruntjs/rm-dep 8d4c183
  • Add recursive 1c7d483
  • Merge pull request #1756 from gruntjs/downgrade-glob 2d4fd38
  • Downgrade glob 902db7c
  • Fix syntax 494f243
  • remove mkdirp b01389e
  • remove dep on rimraf and mkdirp 0072510

gruntjs/grunt@v1.6.0...v1.6.1

v1.6.0

  • Merge pull request #1750 from gruntjs/dep-update-jan28 2805dc3
  • README updates 3f1e423
  • Bump to 16 8fd096d
  • Update more deps 42c5f95
  • Bump eslint and node version 1d88050

gruntjs/grunt@v1.5.3...v1.6.0

v1.5.3

  • Merge pull request #1745 from gruntjs/fix-copy-op 572d79b
  • Patch up race condition in symlink copying. 58016ff
  • Merge pull request #1746 from JamieSlome/patch-1 0749e1d
  • Create SECURITY.md 69b7c50

gruntjs/grunt@v1.5.2...v1.5.3

v1.5.2

  • Update Changelog 7f15fd5
  • Merge pull request #1743 from gruntjs/cleanup-link b0ec6e1
  • Clean up link handling 433f91b

gruntjs/grunt@v1.5.1...v1.5.2

v1.5.1

  • Merge pull request #1742 from gruntjs/update-symlink-test ad22608
  • Fix symlink test 0652305

gruntjs/grunt@v1.5.0...v1.5.1

v1.5.0

  • Updated changelog b2b2c2b
  • Merge pull request #1740 from gruntjs/update-deps-22-10 3eda6ae
  • Update testing matrix 47d32de
  • More updates 2e9161c
  • Remove console log 04b960e
  • Update dependencies, tests... aad3d45
  • Merge pull request #1736 from justlep/main fdc7056

... (truncated)

Changelog

Sourced from grunt's changelog.

v1.6.1 date: 2023-01-31 changes: - Downgrades to glob 7 for Windows compatability - Removes mkdirp and rimraf in favour of node.js APIs. v1.6.0 date: 2023-01-28 changes: - Requires node.js 16+. - template.date now uses dateformat ~4.6.2. - other dependency updates such as glob, rimraf, etc. v1.5.3 date: 2022-04-23 changes: - Patch up race condition in symlink copying. v1.5.2 date: 2022-04-12 changes: - Unlink symlinks when copy destination is a symlink. v1.5.1 date: 2022-04-11 changes: - Fixed symlink destination handling. v1.5.0 date: 2022-04-10 changes: - Updated dependencies. - Add symlink handling for copying files. v1.4.1 date: 2021-05-24 changes: - Fix --preload option to be a known option - Switch to GitHub Actions v1.4.0 date: 2021-04-21 changes: - Security fixes in production and dev dependencies - Liftup/Liftoff upgrade breaking change. Update your scripts to use --preload instead of --require. Ref: gulpjs/liftoff@e7a969d. v1.3.0 date: 2020-08-18 changes: - Switch to use safeLoad for loading YML files via file.readYAML. - Upgrade legacy-log to ~3.0.0. - Upgrade legacy-util to ~2.0.0. v1.2.1 date: 2020-07-07 changes: - Remove path-is-absolute dependency. (PR: gruntjs/grunt#1715) v1.2.0

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by vladikoff, a new releaser for grunt since your current version.


Updates grunt-contrib-clean from 0.6.0 to 2.0.1

Release notes

Sourced from grunt-contrib-clean's releases.

v2.0.1

  • Update deps (#117) 518aa72
  • Update deps, clean up (#116) d226900
  • Bump async from 2.6.1 to 3.2.2 (#113) 395bb66
  • Bump path-parse from 1.0.5 to 1.0.7 (#112) b94a81e
  • Bump js-yaml from 3.5.5 to 3.14.1 (#111) 897e872
  • Bump hosted-git-info from 2.6.0 to 2.8.9 (#110) 947a601
  • Bump lodash from 4.17.15 to 4.17.21 (#109) 569bf5f
  • Bump grunt from 1.0.3 to 1.3.0 (#108) 2d125d1
  • Bump lodash from 4.17.10 to 4.17.15 (#104) c1882fa

gruntjs/grunt-contrib-clean@v2.0.0...v2.0.1

Changelog

Sourced from grunt-contrib-clean's changelog.

v2.0.1: date: 2022-04-15 changes: - Update all dependencies. - Requires node.js > 12. v2.0.0: date: 2018-09-08 changes: - Update all dependencies. - Drop Node.js < 6 support. v1.1.0: date: 2017-04-12 changes: - Update grunt to 1.0.0. - Updates to docs and changelog. - Update internal modules. v1.0.0: date: 2016-02-15 changes: - Drop support for Node.js v0.8. - Grunt peer dependency tagged >= 0.4.5. - Dependency updates. v0.7.0: date: 2015-11-13 changes: - Dependency updates.

Commits

Updates grunt-contrib-compress from 0.12.0 to 2.0.0

Release notes

Sourced from grunt-contrib-compress's releases.

v1.5.0

  • Update changelog e7cb371
  • Add package lock (#213) f6e95ab
  • Updated iltorb to latest minor version for v1.* (#209) 050ae41
  • update tar to 4.4.8 (#211) fd055e9

v1.4.3

No release notes provided.

v1.4.2

No release notes provided.

v1.4.1

No release notes provided.

v1.4.0

No release notes provided.

Changelog

Sourced from grunt-contrib-compress's changelog.

v2.0.0: date: 2020-12-12 changes: - Remove iltorb dependency, now uses zlib brotli features. - Requires node >=10.16. - Dependency and test updates. v1.6.0: date: 2019-10-21 changes: - Update iltorb dependency v1.5.0: date: 2018-04-24 changes: - Update to node 4 as minimum version - update tar to 4.4.8 v1.4.3: date: 2017-05-20 changes: - Update pretty-bytes to v4.0.2. - Add option to not to create empty archive. v1.4.2: date: 2017-05-20 changes: - Update archiver to v1.3.0. v1.4.1: date: 2017-01-20 changes: - Make brotli support optional. v1.4.0: date: 2017-01-18 changes: - Add support for brotli. v1.3.0: date: 2016-05-24 changes: - Update archiver to v1.0. - Fix node 6 support. v1.2.0: date: 2016-03-24 changes: - Dependency update. v1.1.1: date: 2016-03-08 changes: - Fix verbose output. v1.1.0: date: 2016-03-04 changes: - Add ability to replace file in the same location. v1.0.0:

... (truncated)

Commits

Updates grunt-contrib-copy from 0.7.0 to 1.0.0

Changelog

Sourced from grunt-contrib-copy's changelog.

v1.0.0: date: 2016-03-04 changes: - Bump devDependencies. - Add example of using relative path. - Point main to task and remove peerDeps. v0.8.2: date: 2015-10-19 changes: - Fix expand-less copies with multiple files. v0.8.1: date: 2015-08-20 changes: - Update chalk dependency. v0.8.0: date: 2015-02-20 changes: - Performance improvements. - The mode option now also applies to directories. - Fix path issue on Windows.

Commits
  • 85150c7 v1.0.0
  • ee90273 Merge pull request #271 from gruntjs/dev
  • 16b2852 Bump devDependencies.
  • 829032d Merge pull request #268 from nalajcie/master
  • 147a84b tests: disable testing timestamp equity under windows
  • 217819f fix syncing utimes when copying files
  • ade2465 Merge pull request #258 from ricog/patch-1
  • 3a95e08 Add example of using relative path
  • 053e169 Merge pull request #259 from ricog/patch-2
  • 53d78fa Specify expand: true for single file tree example
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by vladikoff, a new releaser for grunt-contrib-copy since your current version.


Updates grunt-contrib-cssmin from 0.6.2 to 5.0.0

Release notes

Sourced from grunt-contrib-cssmin's releases.

v5.0.0

  • Update dependencies.
  • Drop Node.js < 14 support.

v4.0.0

  • Update all dependencies including clean-css v5.x.
  • Drop Node.js < 10 support.

v3.0.0

No release notes provided.

v2.2.1

No release notes provided.

v2.2.0

No release notes provided.

v2.1.0

No release notes provided.

v2.0.0

No release notes provided.

Changelog

Sourced from grunt-contrib-cssmin's changelog.

v5.0.0: date: 2023-05-01 changes: - Update dependencies. - Drop Node.js < 14 support. v4.0.0: date: 2021-02-15 changes: - Update all dependencies including clean-css v5.x. - Drop Node.js < 10 support. v3.0.0: date: 2018-09-07 changes: - Update all dependencies. - Drop Node.js < 6 support. v2.2.1: date: 2017-07-27 changes: - Fix issue with relativeTo for clean-css v4.x. v2.2.0: date: 2017-05-10 changes: - Update clean-css to v4.1.1. v2.1.0: date: 2017-04-17 changes: - Set required Node.js version to >=4 since clean-css 4.x requires that. v2.0.0: date: 2017-02-02 changes: - Update clean-css to v4.0.3. v1.0.2: date: 2016-08-31 changes: - Fix issues for node 6. v1.0.1: date: 2016-03-16 changes: - Downgrade maxmin to support Node.js 0.10. v1.0.0: date: 2016-03-04 changes: - Updated docs. - Point main to task and removed peerDeps. - Update clean-css to v3.4.1. v0.14.0: date: 2015-09-15 changes: - Bump to cssmin ~3.4.0. - Minor test fixes.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by xhmikosr, a new releaser for grunt-contrib-cssmin since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump js-yaml, grunt, grunt-contrib-clean, grunt-contrib-compress, gru…
cd70007 
…nt-contrib-copy and grunt-contrib-cssmin

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 3.14.2 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [grunt](https://github.com/gruntjs/grunt), [grunt-contrib-clean](https://github.com/gruntjs/grunt-contrib-clean), [grunt-contrib-compress](https://github.com/gruntjs/grunt-contrib-compress), [grunt-contrib-copy](https://github.com/gruntjs/grunt-contrib-copy) and [grunt-contrib-cssmin](https://github.com/gruntjs/grunt-contrib-cssmin). These dependencies need to be updated together.


Updates `js-yaml` from 2.0.5 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@2.0.5...3.14.2)

Updates `grunt` from 0.4.5 to 1.6.1
- [Release notes](https://github.com/gruntjs/grunt/releases)
- [Changelog](https://github.com/gruntjs/grunt/blob/main/CHANGELOG)
- [Commits](gruntjs/grunt@v0.4.5...v1.6.1)

Updates `grunt-contrib-clean` from 0.6.0 to 2.0.1
- [Release notes](https://github.com/gruntjs/grunt-contrib-clean/releases)
- [Changelog](https://github.com/gruntjs/grunt-contrib-clean/blob/main/CHANGELOG)
- [Commits](gruntjs/grunt-contrib-clean@v0.6.0...v2.0.1)

Updates `grunt-contrib-compress` from 0.12.0 to 2.0.0
- [Release notes](https://github.com/gruntjs/grunt-contrib-compress/releases)
- [Changelog](https://github.com/gruntjs/grunt-contrib-compress/blob/main/CHANGELOG)
- [Commits](gruntjs/grunt-contrib-compress@v0.12.0...v2.0.0)

Updates `grunt-contrib-copy` from 0.7.0 to 1.0.0
- [Changelog](https://github.com/gruntjs/grunt-contrib-copy/blob/main/CHANGELOG)
- [Commits](gruntjs/grunt-contrib-copy@v0.7.0...v1.0.0)

Updates `grunt-contrib-cssmin` from 0.6.2 to 5.0.0
- [Release notes](https://github.com/gruntjs/grunt-contrib-cssmin/releases)
- [Changelog](https://github.com/gruntjs/grunt-contrib-cssmin/blob/main/CHANGELOG)
- [Commits](https://github.com/gruntjs/grunt-contrib-cssmin/commits/v5.0.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
- dependency-name: grunt
  dependency-version: 1.6.1
  dependency-type: direct:development
- dependency-name: grunt-contrib-clean
  dependency-version: 2.0.1
  dependency-type: direct:development
- dependency-name: grunt-contrib-compress
  dependency-version: 2.0.0
  dependency-type: direct:development
- dependency-name: grunt-contrib-copy
  dependency-version: 1.0.0
  dependency-type: direct:development
- dependency-name: grunt-contrib-cssmin
  dependency-version: 5.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 18, 2025
@dependabot dependabot bot mentioned this pull request Nov 18, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant