chore (deps): bump the patch-updates group across 1 directory with 18 updates

[dependabot]

Bumps the patch-updates group with 18 updates in the / directory:

Package	From	To
@xmldom/xmldom	0.8.13	0.8.15
bson	7.3.1	7.3.3
dompurify	3.4.12	3.4.15
jsrsasign	11.1.3	11.1.5
kbpgp	2.1.17	2.1.19
markdown-it	14.3.0	14.3.2
moment-timezone	0.6.2	0.6.4
ngeohash	0.6.3	0.6.4
otpauth	9.5.1	9.5.2
uuid	14.0.1	14.0.2
@codemirror/search	6.7.1	6.7.2
@codemirror/state	6.7.1	6.7.5
@codemirror/view	6.43.6	6.43.12
css-loader	7.1.4	7.1.5
grunt	1.6.2	1.6.3
html-webpack-plugin	5.6.7	5.6.8
postcss	8.5.19	8.5.28
webpack-bundle-analyzer	5.3.1	5.3.3

Updates @xmldom/xmldom from 0.8.13 to 0.8.15

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.15

Commits

Fixed

• Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
• Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
• Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
• Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
• Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
• Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you, @​ericchiang, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

0.8.14

Commits

Fixed

• Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you, @​bhaswanthc, @​jmestwa-coder, for your contributions

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.15

Fixed

• Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
• Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
• Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
• Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
• Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
• Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you, @​ericchiang, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

0.9.11

Fixed

• Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm
• Security: the processing-instruction grammar regex no longer backtracks quadratically on an unterminated processing instruction (<?… with no closing ?>), preventing a denial-of-service (ReDoS) reachable from DOMParser.parseFromString with default options. GHSA-g53g-w8rj-fmg7
• CharacterData nodeValue and data are now kept in sync [#990](https://github.com/xmldom/xmldom/issues/990)

Chore

• updated dependencies

Thank you, @​bhaswanthc, @​jmestwa-coder, @​stevenobiajulu, for your contributions

0.8.14

Fixed

• Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you, @​bhaswanthc, @​jmestwa-coder, for your contributions

0.9.10

... (truncated)

Commits

• b5b8fb5 0.8.15
• 327508e docs: add 0.8.15 CHANGELOG entry
• f40ccb8 fix: prevent quadratic malformed-tag recovery and normalize() adjacent-text m...
• 3abb093 fix: prevent end-tag whitespace-trim ReDoS via anchored trim (GHSA-x4fp-j954-...
• 2c548f2 fix: prevent quadratic attribute de-duplication via null-prototype membership...
• 08a74b4 test: characterize NamedNodeMap attribute de-duplication before the index ref...
• 954370f fix: prevent quadratic namespace-map memory consumption via prototype-chain i...
• 4430189 fix: report not-well-formed end-tag trailing content (GHSA-6h8r-xr42-gp59)
• 6c3fb5f fix: prevent XML injection via unsafe EntityReference name (GHSA-6gmq-8vp8-gcm6)
• 3b69487 fix: prevent XML injection via unsafe processing instruction target serializa...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.

Updates bson from 7.3.1 to 7.3.3

Release notes

Sourced from bson's releases.

v7.3.3

7.3.3 (2026-09-11)

The MongoDB Node.js team is pleased to announce version 7.3.3 of the bson package!

Release Notes

Fixed BSON.calculateObjectSize infinite hang

Fixed a bug where BSON.calculateObjectSize would hang indefinitely on an object containing a circular reference. The method now throws an exception when a circular reference is detected.

Also a big thank you to @​mcmorisi for his contribution on #912 security warning in EJSON.parse documentation!

Bug Fixes

• NODE-7696: calculateObjectSize hangs indefinitely on an object containing a circular reference (#926) (f35af5c)

Documentation

• API
• Changelog

We invite you to try the bson library immediately, and report any issues to the NODE project.

v7.3.2

7.3.2 (2026-07-31)

The MongoDB Node.js team is pleased to announce version 7.3.2 of the bson package!

Release Notes

calculateObjectSize() now returns accurate byte counts for Int32 and BSONSymbol

Previously, each Int32 or BSONSymbol value caused a 12-byte overcount.

calculateObjectSize() now yields proper size calculations on ES Map's

This release of js-bson fixes an issue where we were incorrectly considering ES Map objects inside calculateObjectSize. This issue did not impact serialization, just size calculation.

Fixed incorrect date boundary in relaxed EJSON

This release of js-bson fixes an issue where the date boundary for relaxed EJSON was incorrectly set to a date 5 hours after the maximum limit of 10,000 AD.

Fixed an issue with ObjectId initialization in Cloudflare Workers

This release of js-bson fixes an issue where we were making crypto calls during module initialization, which is forbidden by Cloudflare Workers and other environments.

Memory optimization via smaller ObjectIds

... (truncated)

Changelog

Sourced from bson's changelog.

7.3.3 (2026-09-11)

Bug Fixes

• NODE-7696: calculateObjectSize hangs indefinitely on an object containing a circular reference (#926) (f35af5c)

7.3.2 (2026-07-31)

Bug Fixes

• NODE-7631: count Int32 and BSONSymbol in calculateObjectSize (#901) (7f948a6)
• NODE-7645: use the first instant of year 10000 as the relaxed EJSON date bound (#917) (9272c9a)
• NODE-7646: count ES Map entries in calculateObjectSize (#910) (8d28b12)
• NODE-7667: remove early initialization from ObjectId (#916) (665286f)

Performance Improvements

• NODE-6246: store ObjectId bytes as four packed integers (#893) (a84229c)

Commits

• 7b8f7b7 chore(main): release 7.3.3 (#927)
• 27f1ef6 test(NODE-7545): update deep_bson.json from mongodb/specifications (#925)
• 9b58a51 docs(NODE-7668): Add security warning to EJSON.parse documentation (#912)
• d3f563e chore(NODE-7806): restrict release_notes to PRs from this repository (#929)
• f35af5c fix(NODE-7696): calculateObjectSize hangs indefinitely on an object containin...
• 8699bb4 chore(NODE-7672): update dependencies (#922)
• 8a9085d docs(NODE-7682): add agents file (#915)
• 9cd2e68 chore(main): release 7.3.2 (#902)
• 9272c9a fix(NODE-7645): use the first instant of year 10000 as the relaxed EJSON date...
• 8d28b12 fix(NODE-7646): count ES Map entries in calculateObjectSize (#910)
• Additional commits viewable in compare view

Updates dompurify from 3.4.12 to 3.4.15

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

Commits

• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• 3067f77 release: 3.4.13 (#1562)
• See full diff in compare view

Updates jsrsasign from 11.1.3 to 11.1.5

Release notes

Sourced from jsrsasign's releases.

Security Fix

• Security fixes
  • CMS.verifySignedData security fix if signerInfos is empty reported by Arpit Jain.
  • DSA security fix not to accept g=1 and y=1 key reported by wzc with fix patch.

Changelog

Sourced from jsrsasign's changelog.

ChangeLog for jsrsasign

• Changes from 11.1.4 to 11.1.5 (2026-Aug-14)

  • npm/README.md update to align README.md
  • index.html update to annaunce the end of support.

• Changes from 11.1.3 to 11.1.4 (2026-Aug-14)

  • Security fixes
    • CMS.verifySignedData security fix if signerInfos is empty reported by Arpit Jain.
    • DSA security fix not to accept g=1 and y=1 key reported by wzc with fix patch.

• Changes from 11.1.2 to 11.1.3 (2026-Apr-18)

  • base64x.js
    • timingSafeEqual and timingSafeEqualImpl added
  • jws.js
    • modified to use timingSafeEqual for HS* signature verification
  • Security fixes:
    • JWS hmac signature validation timing attack fix #654 by @​Kr0emer
  • bugfix
    • jws.js
      • wrong thumbprint calculation for symmetric key (KJUR.jws.JWS.getJWKthumbprint) reported in issue #656 by @​e3stpavel.

• Changes from 11.1.1 to 11.1.2 (2026-Apr-12)

  • Security fixes:
    • HIGH: wrong random for for Node.JS >= 19 and modern browsers (ext/rng.js SecureRandom) reported by Bronson Yen of Calif.io and @​Kr0emer #655.
    • HIGH: ASN.1 Parser Infinite Loop (asn1hex.js) getChildIdx fix to avoid infinite loop reported by Koda Reef.
    • HIGH: DSA Universal Signature Forgery (dsa.js) FIPS 186-4 section 4.7 wrong boundary checking in verifyWithMessageHash reported by Koda Reef, Nicholas Carlini and @​Kr0emer.
    • ASN1HEX.getChildIdx DoS (asn1hex.js) getChildIdx may raise DoS because of lacking value length check reported by Yt(yutengsun) and Franciny S Roj.
    • missing JWS crit header parameter validation (jws.js) as reported by Franciny S Roj. Thank you indeed for those vulnerability reports and/or patches.

• Changes from 11.1.0 to 11.1.1 (2026-Feb-20)

  • security fix for DSA and BigInteger
    • PR #651, #650, #649, #648, #647, #646, #645. Thank you @​Kr0remer
    • After assigned CVE number reports will be added.
  • SECURITY.md added. Thank you @​njg7194

restore KJUR.crypto.Cipher class without RSA/RSAOAEP support

• Changes from 11.0.0 to 11.1.0 (2024-Feb-01)
  • src/crypto.js
    • restore KJUR.crypto.Cipher class without RSA and RSAOAEP encryption/decryption support

... (truncated)

Commits

• c1b8432 update
• 20cb2d2 doc update
• ba77f8d 11.1.4 release
• 9914869 11.1.4 release
• See full diff in compare view

Updates kbpgp from 2.1.17 to 2.1.19

Changelog

Sourced from kbpgp's changelog.

2.1.19 (2026-08-27)

• Fix processing DSA/ECDSA signatures and ElGamal ciphertext.

2.1.18 (2026-08-06)

• Fix error path in bzip2 causing uncaught exceptions during Compressed packet processing.

Commits

• 4594050 Release 2.1.19
• 9179618 Fix rejecting bad signatures / messages in DSA, ECDSA, ElGamal (#233)
• 0691c6e Release 2.1.18
• 4a55f6d Collapse bzip errors in Compressed packet (#236)
• See full diff in compare view

Updates markdown-it from 14.3.0 to 14.3.2

Changelog

Sourced from markdown-it's changelog.

[14.3.2] - 2026-09-12

Security

• Backported 15.0.2 fixes.

[14.3.1] - 2026-08-27

Security

• Backported 15.0.1 fixes.

Commits

• efb9993 14.3.2 released
• daf5a3c Backported 15.0.2 fixes
• a855f10 14.3.1 released
• ad70f6b Backported 15.0.1 fixes
• b407f3b Ignore generated API docs in lint
• bf025ad Prepare package.json for v14 backports
• 2d9bbea fix: recognize lowercase declarations as HTML blocks (CommonMark 4.6) (#1189)
• a311cfb fix: keep literal backslash before space in link destination (CommonMark 6.3)...
• See full diff in compare view

Updates moment-timezone from 0.6.2 to 0.6.4

Release notes

Sourced from moment-timezone's releases.

Release 0.6.4

• Updated data to IANA TZDB 2026d. #1157
• Fixed calendar arithmetic around time zone gaps. #1151
• Fixed default date selection when creating a zoned Moment with only time fields.
  • Object inputs (e.g. moment.tz({ hour: 9 }, zoneName)). #1156
  • String inputs (e.g. moment.tz('09:00', 'HH:mm', zoneName)). #1159
  • Using un-zoned moment() when there is also a zone set with moment.tz.setDefault(zoneName). #1161
    • NOTE: This specific fix only works when also using core moment version 2.31.0 or higher. All other fixes in this release work with all supported versions of moment.

Release 0.6.3

• Updated data to IANA TZDB 2026c. #1148

Changelog

Sourced from moment-timezone's changelog.

0.6.4 2026-09-15

• Updated data to IANA TZDB 2026d. #1157
• Fixed calendar arithmetic around time zone gaps. #1151
• Fixed default date selection when creating a zoned Moment with only time fields.
  • Object inputs (e.g. moment.tz({ hour: 9 }, zoneName)). #1156
  • String inputs (e.g. moment.tz('09:00', 'HH:mm', zoneName)). #1159
  • Using un-zoned moment() when there is also a zone set with moment.tz.setDefault(zoneName). #1161
    • NOTE: This specific fix only works when also using core moment version 2.31.0 or higher. All other fixes in this release work with all supported versions of moment.

0.6.3 2026-07-19

• Updated data to IANA TZDB 2026c. #1148

Commits

• 3722a7d Bump version and build moment-timezone 0.6.4
• 70b06e9 Merge pull request #1161 from moment/mjp/fix-default-zone-date-defaults
• afac5bd [bugfix] Apply default zone to omitted date fields
• 114242a Merge pull request #1159 from moment/mjp/fix-119
• 0662d8b [bugfix] Use target zone for string date defaults
• 9da68c4 data: Add 2026d (#1157)
• 518ab31 build(deps): bump js-yaml and grunt (#1155)
• ffe3e48 build(deps): bump browserslist from 4.21.5 to 4.28.8 (#1154)
• 4282f22 [bugfix] Use target zone for object date defaults (#1156)
• 7030b19 build(deps): bump brace-expansion (#1152)
• Additional commits viewable in compare view

Updates ngeohash from 0.6.3 to 0.6.4

Commits

• 748bcd3 chore: bump version
• 4802e61 chore: update tests
• 88847b0 Merge pull request #46 from gaoflow/fix/odd-bitdepth-int-decode
• faa7061 fix: correct integer geohash decode for odd bitDepth
• 683b0fb Merge pull request #45 from lofimichael/patch-1
• d99b34c Added clarification to geohash.bboxes
• 5aa6e88 (fix) use dedicated browserify script
• 972d918 Merge pull request #40 from ilancoulon/master
• 87ca0f9 asserting numberOfChars for bboxes is not negative
• 034d85b Throwing error when using bboxes with numberOfChars === 0
• See full diff in compare view

Updates otpauth from 9.5.1 to 9.5.2

Release notes

Sourced from otpauth's releases.

v9.5.2

What's Changed

• Bump the github-actions-all group across 1 directory with 7 updates by @​dependabot[bot] in hectorm/otpauth#711

Full Changelog: hectorm/otpauth@v9.5.1...v9.5.2

Commits

• 5a0cb60 9.5.2
• 94f1fcc Update QuickJS version to 2026-06-04
• fac0c5c Update hectorm/ghaction-setup-quickjs
• 88bdce0 Harden and align hex/base32 secret decoding
• c431143 Bump the github-actions-all group across 1 directory with 7 updates (#711)
• b6e3a62 Update dependencies
• See full diff in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Commits

• fd59f02 chore(main): release 14.0.2 (#967)
• f3c564e docs: point the Node support permalink at the CI version matrix (#974)
• b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
• 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
• ea83515 docs: cleanup API summary (#968)
• ac36860 chore: pin publint version in CI (#966)
• a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
• See full diff in compare view

Updates @codemirror/search from 6.7.1 to 6.7.2

Commits

• See full diff in compare view

Updates @codemirror/state from 6.7.1 to 6.7.5

Commits

• See full diff in compare view

Updates @codemirror/view from 6.43.6 to 6.43.12

Commits

• See full diff in compare view

Updates css-loader from 7.1.4 to 7.1.5

Release notes

Sourced from css-loader's releases.

v7.1.5

7.1.5 (2026-08-28)

Bug Fixes

• strip BOM before processing with postcss (#1684) (bd20834)

Changelog

Sourced from css-loader's changelog.

7.1.5 (2026-08-28)

Bug Fixes

• strip BOM before processing with postcss (#1684) (bd20834)

Commits

• be04ec2 chore(release): 7.1.5
• 405bdde docs: deprecate css-loader in favor of webpack's built-in CSS support (#1683)
• bd20834 fix: strip BOM before processing with postcss (#1684)
• 488cdb1 chore(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#1663)
• fd4cb47 chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 (#1659)
• 4bf84fa docs: clarify style-loader usage in Getting Started (#1656)
• d7441e5 chore(deps): bump immutable from 5.1.3 to 5.1.5 (#1654)
• ca53a77 chore(deps): bump minimatch (#1653)
• See full diff in compare view

Updates grunt from 1.6.2 to 1.6.3

Changelog

Sourced from grunt's changelog.

v1.6.3

• date: 2026-07-28
• changes:
  • Update js-yaml to 3.15.0 to fix CVE (gruntjs/grunt#1803)

Commits

• d71f9aa 1.6.3
• 33280c2 docs: Convert changelog to markdown
• 8534749 Update js-yaml to 3.15.0 to fix CVE
• 1d8bf42 Update copyright to OpenJS Foundation
• See full diff in compare view

Updates html-webpack-plugin from 5.6.7 to 5.6.8

Changelog

Sourced from html-webpack-plugin's changelog.

5.6.8 (2026-07-25)

Bug Fixes

• extend @​rspack/core peer dependency range (#1893) (8057b14)

Commits

• cf9c701 chore(release): 5.6.8
• 8057b14 fix: extend @​rspack/core peer dependency range (#1893)
• See full diff in compare view

Updates postcss from 8.5.19 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

Changelog

Sourced from postcss's changelog.

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

Commits

• e544bff Release 8.5.28 version
• f8fc252 Typo
• 5039fd7 Add missed release notes
• ae40ca4 Release 8.5.27 version
• 62b1626 Fix linter
• 1dba938 Update dependencies
• 3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
• 6d23bc3...

  Description has been truncated