Skip to content

deps(deps): bump the production-dependencies group across 1 directory with 6 updates #551

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: publish
Choose a base branch
from
Open

deps(deps): bump the production-dependencies group across 1 directory with 6 updates #551

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 23, 2025 •
edited
Loading

Bumps the production-dependencies group with 6 updates in the / directory:

Package From To
chai 6.2.0 6.2.1
glob 11.0.3 13.0.0
gulp-sourcemaps 2.6.5 3.0.0
js-yaml 4.1.0 4.1.1
md-to-pdf 5.2.4 5.2.5
sass 1.93.2 1.94.2

Updates chai from 6.2.0 to 6.2.1

Release notes

Sourced from chai's releases.

v6.2.1

What's Changed

New Contributors

Full Changelog: chaijs/chai@v6.2.0...v6.2.1

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for chai since your current version.


Updates glob from 11.0.3 to 13.0.0

Changelog

Sourced from glob's changelog.

changeglob

13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

  • Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)
  • Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.
  • Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

  • Drop support for node before v20

10.4

  • Add includeChildMatches: false option
  • Export the Ignore class

10.3

  • Add --default -p flag to provide a default pattern
  • exclude symbolic links to directories when follow and nodir are both set

10.2

  • Add glob cli

10.1

  • Return '.' instead of the empty string '' when the current working directory is returned as a match.
  • Add posix: true option to return / delimited paths, even on

... (truncated)

Commits

Updates gulp-sourcemaps from 2.6.5 to 3.0.0

Release notes

Sourced from gulp-sourcemaps's releases.

Security Fixes

Nothing changed to the overall API.

However the following security fixes lead to the following:

Commits
  • 2bcfcbb 3.0.0
  • d8bed0c Merge pull request #373 from adrian3d/update/doc-gulp-4
  • 5686db3 Merge pull request #380 from kennyr87/gh-378/upgrade-css
  • 2c66b2c Depdenency: Upgrade css to v3.0.0
  • 9a9289b Breaking: Drop Node <6 support & upgrade identity-map which uses changes CSS ...
  • 11d1e31 Update doc to gulp 4
  • bd0aeb0 Docs: Temporarily point at phated/gulp-sourcemaps for AppVeyor badge
  • 7e69e97 Build: Ensure tests pass on Windows
  • 404eb5b Docs: Update badges
  • 8a22ecc Scaffold: Convert repository to use gulp patterns (closes #357) (#367)
  • See full diff in compare view

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates md-to-pdf from 5.2.4 to 5.2.5

Changelog

Sourced from md-to-pdf's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

Commits
  • 9e74457 5.2.5
  • 46bdcf2 fix: override the javascript engine of gray-matter correctly
  • 7e0b9fc docs(readme): update badge
  • 23e5c5c chore(deps): bump puppeteer from 21.3.4 to 21.5.0 (#270)
  • ac5a93f chore(deps-dev): bump @​types/semver from 7.5.3 to 7.5.4 (#267)
  • 46e9403 chore(deps-dev): bump @​types/serve-handler from 6.1.2 to 6.1.3 (#266)
  • d09d41e chore(deps-dev): bump @​types/semver from 7.5.1 to 7.5.3 (#264)
  • b4ebf74 chore(deps): bump highlight.js from 11.8.0 to 11.9.0 (#261)
  • c2486f5 chore(deps-dev): bump @​types/serve-handler from 6.1.1 to 6.1.2 (#260)
  • e534042 chore(deps): bump puppeteer from 21.1.1 to 21.3.4 (#258)
  • Additional commits viewable in compare view

Updates sass from 1.93.2 to 1.94.2

Release notes

Sourced from sass's releases.

Dart Sass 1.94.2

To install Sass 1.94.2, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Command-Line Interface

  • Using --fatal-deprecation <version> no longer emits warnings about deprecations that are obsolete.

Dart API

  • Deprecation.forVersion now excludes obsolete deprecations from the set it returns.

JS API

  • Excludes obsolete deprecations from fatalDeprecations when a Version is passed.

Node.js Embedded Host

  • Fix a bug where a variable could be used before it was initialized during async compilation.

See the full changelog for changes in earlier releases.

Dart Sass 1.94.1

To install Sass 1.94.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.94.0

To install Sass 1.94.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Potentially breaking compatibility fix: @function rules whose names begin with -- are now parsed as unknown at-rules to support the plain CSS @function rule. Within this rule, the result property is parsed as raw CSS just like custom properties.

  • Potentially breaking compatibility fix: @mixin rules whose names begin with -- are now errors. These are not yet parsed as unknown at-rules because no browser currently supports CSS mixins.

... (truncated)

Changelog

Sourced from sass's changelog.

1.94.2

Command-Line Interface

  • Using --fatal-deprecation <version> no longer emits warnings about deprecations that are obsolete.

Dart API

  • Deprecation.forVersion now excludes obsolete deprecations from the set it returns.

JS API

  • Excludes obsolete deprecations from fatalDeprecations when a Version is passed.

Node.js Embedded Host

  • Fix a bug where a variable could be used before it was initialized during async compilation.

1.94.1

  • No user-visible changes.

1.94.0

  • Potentially breaking compatibility fix: @function rules whose names begin with -- are now parsed as unknown at-rules to support the plain CSS @function rule. Within this rule, the result property is parsed as raw CSS just like custom properties.

  • Potentially breaking compatibility fix: @mixin rules whose names begin with -- are now errors. These are not yet parsed as unknown at-rules because no browser currently supports CSS mixins.

1.93.3

  • Fix a performance regression that was introduced in 1.92.0.
Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for sass since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(deps): bump the production-dependencies group across 1 directory…
6a4d5e8 
… with 6 updates

Bumps the production-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [chai](https://github.com/chaijs/chai) | `6.2.0` | `6.2.1` |
| [glob](https://github.com/isaacs/node-glob) | `11.0.3` | `13.0.0` |
| [gulp-sourcemaps](https://github.com/gulp-sourcemaps/gulp-sourcemaps) | `2.6.5` | `3.0.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` |
| [md-to-pdf](https://github.com/simonhaenisch/md-to-pdf) | `5.2.4` | `5.2.5` |
| [sass](https://github.com/sass/dart-sass) | `1.93.2` | `1.94.2` |



Updates `chai` from 6.2.0 to 6.2.1
- [Release notes](https://github.com/chaijs/chai/releases)
- [Changelog](https://github.com/chaijs/chai/blob/main/History.md)
- [Commits](chaijs/chai@v6.2.0...v6.2.1)

Updates `glob` from 11.0.3 to 13.0.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v11.0.3...v13.0.0)

Updates `gulp-sourcemaps` from 2.6.5 to 3.0.0
- [Release notes](https://github.com/gulp-sourcemaps/gulp-sourcemaps/releases)
- [Commits](gulp-sourcemaps/gulp-sourcemaps@v2.6.5...v3.0.0)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `md-to-pdf` from 5.2.4 to 5.2.5
- [Release notes](https://github.com/simonhaenisch/md-to-pdf/releases)
- [Changelog](https://github.com/simonhaenisch/md-to-pdf/blob/master/changelog.md)
- [Commits](simonhaenisch/md-to-pdf@v5.2.4...v5.2.5)

Updates `sass` from 1.93.2 to 1.94.2
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.93.2...1.94.2)

---
updated-dependencies:
- dependency-name: chai
  dependency-version: 6.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: glob
  dependency-version: 13.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: gulp-sourcemaps
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: md-to-pdf
  dependency-version: 5.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sass
  dependency-version: 1.94.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 23, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@dalekunce dalekunce

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dalekunce