chore(deps-dev): bump gulp from 3.9.1 to 5.0.1

[dependabot]

Bumps gulp from 3.9.1 to 5.0.1.

Release notes

Sourced from gulp's releases.

gulp v5.0.1

Bug Fixes

• Avoid globbing before read stream is opened (#2839) (19122f3)
• Avoid Node.js deprecation warning for fs.Stats (#2838) (69a5d0e)
• Support top-level await on Node 22.12+ (#2836) (04b4a74)

gulp v5.0.0

We've tried to provide a high-level changelog for gulp v5 below, but it doesn't contain all changes from the 60+ dependencies that we maintain.

Please see individual changelogs to drill down into all changes that were made.

⚠ BREAKING CHANGES

• Drop support for Node.js <10.13
• Default stream encoding to UTF-8
• Standardized on anymatch library for globbing paths. All globs should work the same between src and watch now!
• Removed support for ordered globs. This aligns with the chokidar globbing implementation. If you need your globs to be ordered, you can use ordered-read-stream
• All globs and paths are normalized to unix-like filepaths
• Only allow JS variants for .gulp.* config files
• Removed support for alpha releases of v4 from gulp-cli
• Removed the --verify flag
• Renamed the --require flag to --preload to avoid conflicting with Node.js flags
• Removed many legacy and deprecated loaders
• Upgrade to chokidar v3
• Clone Vinyl objects with stream contents using teex, but no longer wait for all streams to flow before cloned streams will receive data
• Stop using process.umask() to make directories, instead falling back to Node's default mode
• Throw on non-function, non-string option coercers
• Drop support of Node.js snake_case flags
• Use a Symbol for attaching the gulplog namespace to the store
• Use a Symbol for attaching the gulplog store to the global
• Use sha256 to hash the v8flags cache into a filename

Features

• Streamlined the dependency tree
• Switch all streams implementation to Streamx
• Rewrote glob-stream to use a custom directory walk that relies on newer Node.js features and is more performant than old implementation
• Implement translation support for all CLI messages and all messages passing through gulplog
• Allow users to customize or remove the timestamp from their logs
• Upgraded gulplog to v2. Messages logged via v1 will also display a deprecated warning. Plugins should update to v2 as the community upgrades to gulp 5
• Added support for gulpile.cjs and gulpfile.mjs
• Add support for swc, esbuild, sucrase, and mdx loaders
• Provide an ESM export (#2760) (b00de68)
• Support sourcemap handling on streaming Vinyl contents

... (truncated)

Changelog

Sourced from gulp's changelog.

5.0.1 (2025-06-01)

Bug Fixes

• Avoid globbing before read stream is opened (#2839) (19122f3)
• Avoid Node.js deprecation warning for fs.Stats (#2838) (69a5d0e)
• Support top-level await on Node 22.12+ (#2836) (04b4a74)

5.0.0 (2024-03-29)

We've tried to provide a high-level changelog for gulp v5 below, but it doesn't contain all changes from the 60+ dependencies that we maintain.

Please see individual changelogs to drill down into all changes that were made.

⚠ BREAKING CHANGES

• Drop support for Node.js <10.13
• Default stream encoding to UTF-8
• Standardized on anymatch library for globbing paths. All globs should work the same between src and watch now!
• Removed support for ordered globs. This aligns with the chokidar globbing implementation. If you need your globs to be ordered, you can use ordered-read-stream
• All globs and paths are normalized to unix-like filepaths
• Only allow JS variants for .gulp.* config files
• Removed support for alpha releases of v4 from gulp-cli
• Removed the --verify flag
• Renamed the --require flag to --preload to avoid conflicting with Node.js flags
• Removed many legacy and deprecated loaders
• Upgrade to chokidar v3
• Clone Vinyl objects with stream contents using teex, but no longer wait for all streams to flow before cloned streams will receive data
• Stop using process.umask() to make directories, instead falling back to Node's default mode
• Throw on non-function, non-string option coercers
• Drop support of Node.js snake_case flags
• Use a Symbol for attaching the gulplog namespace to the store
• Use a Symbol for attaching the gulplog store to the global
• Use sha256 to hash the v8flags cache into a filename

Features

• Streamlined the dependency tree
• Switch all streams implementation to Streamx
• Rewrote glob-stream to use a custom directory walk that relies on newer Node.js features and is more performant than old implementation
• Implement translation support for all CLI messages and all messages passing through gulplog
• Allow users to customize or remove the timestamp from their logs
• Upgraded gulplog to v2. Messages logged via v1 will also display a deprecated warning. Plugins should update to v2 as the community upgrades to gulp 5
• Added support for gulpile.cjs and gulpfile.mjs
• Add support for swc, esbuild, sucrase, and mdx loaders
• Provide an ESM export (#2760) (b00de68)
• Support sourcemap handling on streaming Vinyl contents

... (truncated)

Commits

• 0003e9f chore: release 5.0.1 (#2837)
• 19122f3 fix: Avoid globbing before read stream is opened (#2839)
• 69a5d0e fix: Avoid Node.js deprecation warning for fs.Stats (#2838)
• 04b4a74 fix: Support top-level await on Node 22.12+ (#2836)
• c90e79e chore: Fix CI (#2835)
• 5412605 chore(docs): Update async completion document for newer RxJS (#2831)
• 2fa4981 chore: Update glob docs with replacement to ordered globs (#2788)
• fe9dee6 chore: Remove locale docs (#2787)
• a85eddb chore: Remove node-glob options from docs (#2786)
• 9c818e6 chore: update src.md docs to add encoding parameter
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dj4oC]

• Security: no findings (gulp 3.9.1 → 5.0.1, build-tooling devDependency)
• Stability: CI red on Commits / Validate semantic commits and build / Build; JS Unit/PHP jobs pass. gulp 3→5 is a major bump of the build tool itself — worth confirming the build actually still runs after this, since build/Build is failing.
• Performance: no findings
• Test coverage: n/a (dependency bump)
• TODOs found: 0
• Dependency touched: yes — gulp (MIT), major bump
• CI status: failing (Commits, build)

Verdict

Not mergeable as-is — build check is red. Not approving until CI is green.

🤖 Automated review by Claude Code (security · stability · performance · coverage)

---

Generated by Claude Code

[DeepDiver1975]

@dependabot rebase

[DeepDiver1975]

Holding: CI is failing (not a rebase conflict). Failing check(s): build / Build. A rebase won't fix this — needs a human/upstream fix.

[DeepDiver1975]

@dependabot rebase

[DeepDiver1975]

Holding: CI is failing (not a rebase conflict) — root-cause refinement, supersedes my earlier comment on this PR (which only named the failing check). Run 29815077608 is past log retention (HTTP 410), so this was re-derived structurally from gulpfile.js at head of branch.

This repo is still genuinely on the gulp 3 API (package.json has gulp ^3.9.1), and gulpfile.js uses the task-dependency-array signature that gulp 4 removed:

gulp.task('lint', ['jslint']);                                   // line 84
gulp.task('default', ['lint', '_buildSource', '_buildVendor']);      // line 85
gulp.task('build', ['lint', '_buildSource']);                    // line 86
gulp.task('_buildSource', ['_buildAndMinifyCSSSources', ...]);    // line 94
gulp.task('_buildVendor', ['_buildAndMinifyCSSVendor', ...]);     // line 95
gulp.watch(watchSources, ['_buildSource']);                       // line 217

gulp 4 dropped gulp.task(name, deps, fn) in favour of gulp.series / gulp.parallel, so on 5.0.1 every one of those calls fails with "Task function must be specified". On top of that, line 33 uses gulp-sync (require('gulp-sync')(gulp)), a gulp-3-only sequencing shim made obsolete by gulp.series.

This is a gulpfile migration, not a version pin: all the composite tasks above have to be rewritten as gulp.series/gulp.parallel and gulp-sync dropped. A rebase will not fix this.