Skip to content

Bump js-yaml, cssnano, eslint, karma-coverage and vue-loader - #69

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-588af744f9
Closed

Bump js-yaml, cssnano, eslint, karma-coverage and vue-loader#69
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-588af744f9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown

Bumps js-yaml to 3.15.0 and updates ancestor dependencies js-yaml, cssnano, eslint, karma-coverage and vue-loader. These dependencies need to be updated together.

Updates js-yaml from 3.12.0 to 3.15.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

  • Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
  • Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

  • maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

  • Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

  • Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

  • [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

  • Added named exports for schemas, tags, parser events and AST utilities.
  • Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
  • Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
  • Added dump() transform option for changing the generated AST before rendering.
  • Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
  • Added formal data layers (events and AST) for modular data pipelines.
    • Added low-level parser (to events), presenter and visitor APIs.
  • Added the YAML Test Suite to the test set.

Changed

  • See the migration guide for upgrade notes.
  • Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

Updates cssnano from 3.10.0 to 8.0.2

Release notes

Sourced from cssnano's releases.

v8.0.2

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.1...cssnano@8.0.2

v8.0.1

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.0...cssnano@8.0.1

v8.0.0

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.9...cssnano@8.0.0

v7.1.9

Bug Fixes

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.8...cssnano@7.1.9

v7.1.8

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.7...cssnano@7.1.8

v.7.1.7

This release is idnetical to the previous one, but is being published to ensure that the latest versions of postcss-normalize-repeat-style and postcss-normalize-positions are uploaded to the npm registry.

... (truncated)

Commits
  • 185e1c7 Publish cssnano 8.0.2
  • 2ce8c2d chore: update the postcs peer dependency
  • 99bd9c1 docs: update website dependencies
  • 2ca8d4a chore: update development deps
  • b245a0b fix: update caniuse-api
  • 3bf3f4d chore: update postcss-selector-parser
  • 7343c87 fix: preserve apostrophes in svg data uris (#1819)
  • 964b9db chore(util): add benchmark + cpuprofile tooling (#1812)
  • 54a8db2 Include postcss-discard-overridden types in package
  • e0e39ae perf(postcss-merge-longhand): skip processors with no relevant decls
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cssnano since your current version.


Updates eslint from 4.19.1 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

  • 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

v10.7.0

Features

  • cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
  • f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by eslintbot, a new releaser for eslint since your current version.


Updates karma-coverage from 1.1.2 to 2.2.1

Release notes

Sourced from karma-coverage's releases.

v2.2.1

2.2.1 (2023-06-23)

Bug Fixes

  • exit code when reporter file is not provided (1388186)

v2.2.0

2.2.0 (2022-02-10)

Features

  • update Istanbul packages (24aac11)

v2.1.1

2.1.1 (2022-02-05)

Bug Fixes

v2.1.0

2.1.0 (2021-12-01)

Bug Fixes

  • deps: update main and dev dependencies (c20d982)

Features

  • reporter: log coverage threshold as a warning fixed #432 (a6c95d8)

v2.0.3

2.0.3 (2020-07-24)

Bug Fixes

  • report: waiting promise resolve in onExist method fix #418 (c93f061)

v2.0.2

2.0.2 (2020-04-13)

... (truncated)

Changelog

Sourced from karma-coverage's changelog.

2.2.1 (2023-06-23)

Bug Fixes

  • exit code when reporter file is not provided (1388186)

2.2.0 (2022-02-10)

Features

  • update Istanbul packages (24aac11)

2.1.1 (2022-02-05)

Bug Fixes

2.1.0 (2021-12-01)

Bug Fixes

  • deps: update main and dev dependencies (c20d982)

Features

  • reporter: log coverage threshold as a warning fixed #432 (a6c95d8)

2.0.3 (2020-07-24)

Bug Fixes

  • report: waiting promise resolve in onExist method fix #418 (c93f061)

2.0.2 (2020-04-13)

Bug Fixes

  • reporter: update calls to match new API in istanbul-lib-report fix #398 (#403) (4962a70)
  • remove information about old istanbul lib (#404) (5cf931a)

... (truncated)

Commits
  • 55eb8a8 chore(release): 2.2.1 [skip ci]
  • 1388186 fix: exit code when reporter file is not provided
  • 06fb9ad chore(release): 2.2.0 [skip ci]
  • 24aac11 feat: update Istanbul packages
  • 9e8492c chore(deps): bump follow-redirects from 1.14.5 to 1.14.7
  • 68daaa7 chore(deps): bump node-fetch from 2.6.6 to 2.6.7
  • 2675374 chore(release): 2.1.1 [skip ci]
  • bca2c69 fix: handle unexpected error when generating code coverage
  • 44b31eb fix: race condition between the Karma shutdown and coverage writing
  • 4adb3ef chore(deps): update indirect deps
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karmarunnerbot, a new releaser for karma-coverage since your current version.


Updates vue-loader from 13.7.3 to 17.4.2

Release notes

Sourced from vue-loader's releases.

v17.3.1

Bug Fixes

  • do not skip style post loader for v-bind() in non-scoped CSS (d7071bb), closes #2061

v17.3.0

Bug Fixes

Features

  • skip normal css files without scoped flag in stylePostLoader (#2053) (98782e7)

v17.2.2

Bug Fixes

v17.2.1

Features

  • A new experimentalInlineMatchResource option (webpack 5 only), which leverages webpack 5's inline matchResource feature in the underlying implementation, and works well with the experiments.css feature This also makes vue-loader compatible with Rspack (#2046) (3149f6d).

Note: v17.2.0 was released by accident; it has the same content as v17.1.2, therefore not included in the Releases page.

v17.1.2

Bug Fixes

  • keep build stable when run in a different path (#2040) (a81dc0f)
  • properly close the watcher after webpack 4 tests (40b93b9)

v17.1.1

Bug Fixes

  • support experimental propsDestructure and defineModel options (6269698)

v17.1.0

Bug Fixes

Features

  • support 3.3 imported types hmr (bbd98fc)

Full Changelog: vuejs/vue-loader@v17.0.1...v17.1.0

... (truncated)

Changelog

Sourced from vue-loader's changelog.

17.4.2 (2023-12-30)

Bug Fixes

  • pass compilerOptions to sfc parse & re-enable AST reuse (d2a2e05)

17.4.1 (2023-12-30)

Bug Fixes

  • (temporarily) disable template ast reuse (31b03af)

17.4.0 (2023-12-25)

Features

  • leverage ast reuse in 3.4 (479835f)

17.3.1 (2023-10-31)

Bug Fixes

  • do not skip style post loader for v-bind() in CSS (d7071bb), closes #2061

17.3.0 (2023-10-07)

Bug Fixes

Features

  • skip normal css files without scoped flag in stylePostLoader (#2053) (98782e7)

17.2.2 (2023-06-02)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 3.15.0 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [cssnano](https://github.com/cssnano/cssnano), [eslint](https://github.com/eslint/eslint), [karma-coverage](https://github.com/karma-runner/karma-coverage) and [vue-loader](https://github.com/vuejs/vue-loader). These dependencies need to be updated together.


Updates `js-yaml` from 3.12.0 to 3.15.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.12.0...3.15.0)

Updates `cssnano` from 3.10.0 to 8.0.2
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/compare/v3.10.0...cssnano@8.0.2)

Updates `eslint` from 4.19.1 to 10.8.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v4.19.1...v10.8.0)

Updates `karma-coverage` from 1.1.2 to 2.2.1
- [Release notes](https://github.com/karma-runner/karma-coverage/releases)
- [Changelog](https://github.com/karma-runner/karma-coverage/blob/master/CHANGELOG.md)
- [Commits](karma-runner/karma-coverage@v1.1.2...v2.2.1)

Updates `vue-loader` from 13.7.3 to 17.4.2
- [Release notes](https://github.com/vuejs/vue-loader/releases)
- [Changelog](https://github.com/vuejs/vue-loader/blob/main/CHANGELOG.md)
- [Commits](https://github.com/vuejs/vue-loader/commits/v17.4.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 3.15.0
  dependency-type: indirect
- dependency-name: cssnano
  dependency-version: 8.0.2
  dependency-type: direct:development
- dependency-name: eslint
  dependency-version: 10.8.0
  dependency-type: direct:development
- dependency-name: karma-coverage
  dependency-version: 2.2.1
  dependency-type: direct:development
- dependency-name: vue-loader
  dependency-version: 17.4.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@dependabot @github

dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Author

Superseded by #73.

@dependabot dependabot Bot closed this Aug 8, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-588af744f9 branch August 8, 2026 05:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant