chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #21

dependabot · 2025-02-15T07:54:59Z

Bumps the npm_and_yarn group with 3 updates in the / directory: postcss, rollup and vite.

Updates postcss from 8.4.20 to 8.5.2

Release notes

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@romainmenke during his work on Stylelint added Input#document in additional to Input#css.
root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"
Thanks to Sponsors

This release was possible thanks to our community.

If your company wants to support the sustainability of front-end infrastructure or wants to give some love to PostCSS, you can join our supporters by:

Tidelift with a Spotify-like subscription model supporting all projects from your lock file.

Direct donations at GitHub Sponsors or Open Collective.

8.4.49

Fixed custom syntax without source.offset (by @romainmenke).

8.4.48

Fixed position calculation in error/warnings methods (by @romainmenke).

8.4.47

Removed debug code.

8.4.46

Fixed Cannot read properties of undefined (reading 'before').

8.4.45

Removed unnecessary fix which could lead to infinite loop.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

Added Input#document for sources like CSS-in-JS or HTML (by @romainmenke).

8.4.49

Fixed custom syntax without source.offset (by @romainmenke).

8.4.48

Fixed position calculation in error/warnings methods (by @romainmenke).

8.4.47

Removed debug code.

8.4.46

Fixed Cannot read properties of undefined (reading 'before').

8.4.45

Removed unnecessary fix which could lead to infinite loop.

8.4.44

Another way to fix markClean is not a function error.

8.4.43

Fixed markClean is not a function error.

8.4.42

Fixed CSS syntax error on long minified files (by @varpstar).

8.4.41

Fixed types (by @nex3 and @querkmachine).

Cleaned up RegExps (by @bluwy).

8.4.40

Moved to getter/setter in nodes types to help Sass team (by @nex3).

8.4.39

Fixed CssSyntaxError types (by @romainmenke).

8.4.38

Fixed endIndex: 0 in errors and warnings (by @romainmenke).

8.4.37

Fixed original.column are not numbers error in another case.

8.4.36

... (truncated)

Commits

692fcde Release 8.5.2 version
b70e98f Update dependencies
ba587e3 Fix end position of rules with ownSemicon (#2012)
7b02c75 Release 8.5.1 version
4c15339 Update dependencies
7efe91e Improve backwards compat for Input#document (#2000)
6873270 Release 8.5 version
4223bb9 Fix 80 columns limit
80e2401 Add Input#document (#1996)
6f86879 Update dependencies
Additional commits viewable in compare view

Updates rollup from 2.79.1 to 2.79.2

Release notes

Sourced from rollup's releases.

v.2.79.2

2.79.2

2024-09-26

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

Changelog

Sourced from rollup's changelog.

2.79.2

2024-09-26

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

3.29.5

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

4.22.4

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5670: refactor: Use object.prototype to check for reserved properties (@YuHyeonWook)

#5671: Fix DOM Clobbering CVE (@lukastaegert)

4.22.3

2024-09-21

Bug Fixes

Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (#5669)

Pull Requests

#5669: Ensure impure dependencies of pure modules are added (@lukastaegert)

4.22.2

... (truncated)

Commits

c9bd03d 2.79.2
48aef33 fix: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (#5677)
See full diff in compare view

Updates vite from 3.2.5 to 4.5.9

Release notes

Sourced from vite's releases.

v4.5.9

Please refer to CHANGELOG.md for details.

v4.5.8

Please refer to CHANGELOG.md for details.

v4.5.7

Please refer to CHANGELOG.md for details.

v4.5.6

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v4.5.5

Please refer to CHANGELOG.md for details.

v4.5.4

Please refer to CHANGELOG.md for details.

v3.2.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

4.5.9 (2025-01-21)

fix: preview.allowedHosts with specific values was not respected (#19246) (0bc52e0), closes #19246

fix: allow CORS from loopback addresses by default (#19249) (8f63cd6), closes #19249

4.5.8 (2025-01-20)

fix: try parse server.origin URL (#19241) (3680bad), closes #19241

4.5.7 (2025-01-20)

fix: crypto.getRandomValues is not available in old Node versions (#19237) (f4d3c46), closes #19237

4.5.6 (2025-01-20)

fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (ef1049d)

fix!: default server.cors: false to disallow fetching from untrusted origins (07b36d5)

fix: verify token for HMR WebSocket connection (c065a77)

4.5.5 (2024-09-16)

4.5.4 (2024-09-16)

fix: avoid DOM Clobbering gadget in getRelativeUrlFromDocument (#18115) (e812716), closes #18115

fix: backport #18112, fs raw query (b901438), closes #18112

4.5.3 (2024-03-24)

fix: fs.deny with globs with directories (#16250) (96a7f3a), closes #16250

4.5.2 (2024-01-19)

fix: fs deny for case insensitive systems (#15653) (eeec23b), closes #15653

... (truncated)

Commits

edad4d2 release: v4.5.9
8f63cd6 fix: allow CORS from loopback addresses by default (#19249)
0bc52e0 fix: preview.allowedHosts with specific values was not respected (#19246)
947f0c1 release: v4.5.8
3680bad fix: try parse server.origin URL (#19241)
fe86acb release: v4.5.7
f4d3c46 fix: crypto.getRandomValues is not available in old Node versions (#19237)
9e460f5 release: v4.5.6
ef1049d fix!: check host header to prevent DNS rebinding attacks and introduce `serve...
c065a77 fix: verify token for HMR WebSocket connection
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 3 updates in the / directory: [postcss](https://github.com/postcss/postcss), [rollup](https://github.com/rollup/rollup) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `postcss` from 8.4.20 to 8.5.2 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.20...8.5.2) Updates `rollup` from 2.79.1 to 2.79.2 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v2.79.1...v2.79.2) Updates `vite` from 3.2.5 to 4.5.9 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v4.5.9/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v4.5.9/packages/vite) --- updated-dependencies: - dependency-name: postcss dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot requested a review from hbsnow as a code owner February 15, 2025 07:55

dependabot bot added the dependencies Pull requests that update a dependency file label Feb 15, 2025

This was referenced Feb 15, 2025

chore(deps): bump postcss from 8.4.20 to 8.5.2 #18

Closed

chore(deps): bump rollup from 2.79.1 to 2.79.2 #19

Closed

chore(deps): bump vite from 3.2.5 to 4.5.9 #20

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #21

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #21

dependabot bot commented on behalf of github Feb 15, 2025

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #21

Are you sure you want to change the base?

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #21

Conversation

dependabot bot commented on behalf of github Feb 15, 2025

8.5.2

8.5.1

8.5 “Duke Alloces”

Thanks to Sponsors

8.4.49

8.4.48

8.4.47

8.4.46

8.4.45

8.5.2

8.5.1

8.5 “Duke Alloces”

8.4.49

8.4.48

8.4.47

8.4.46

8.4.45

8.4.44

8.4.43

8.4.42

8.4.41

8.4.40

8.4.39

8.4.38

8.4.37

8.4.36

v.2.79.2

2.79.2

Bug Fixes

Pull Requests

2.79.2

Bug Fixes

Pull Requests

3.29.5

Bug Fixes

Pull Requests

4.22.4

Bug Fixes

Pull Requests

4.22.3

Bug Fixes

Pull Requests

4.22.2

v4.5.9

v4.5.8

v4.5.7

v4.5.6

v4.5.5

v4.5.4

v3.2.11

4.5.9 (2025-01-21)

4.5.8 (2025-01-20)

4.5.7 (2025-01-20)

4.5.6 (2025-01-20)

4.5.5 (2024-09-16)

4.5.4 (2024-09-16)

4.5.3 (2024-03-24)

4.5.2 (2024-01-19)