Bumps the npm_and_yarn group with 2 updates in the / directory: js-yaml [QUARANTINED_URL: github.com] and postcss [QUARANTINED_URL: github.com].
Updates js-yaml from 5.2.1 to 5.2.2
Changelog
Sourced from js-yaml's changelog.
[5.2.2] - 2026-07-24
Fixed
- Quote flow scalars where a colon precedes a flow indicator, #773.
Security
- Avoid exponential parsing time for nested flow sequence pairs.
Commits
3c29559 5.2.2 released3e5240f parser: avoid reparsing flow sequence pair keysbd7ebb2 fix: quote flow scalars where a colon precedes a flow indicator (#773)- See full diff in compare view
Updates postcss from 8.5.16 to 8.5.23
Release notes
Sourced from postcss's releases.
8.5.23
- Do not load source map without
opts.from for security reasons.
8.5.22
8.5.21
8.5.20
8.5.19
- Fixed cleaning
before for new nodes inserted to Root (by @MahinAnowar).
8.5.18
- Restricted loading previous source maps file to the
opts.from folder for security reasons (use unsafeMap: true to disable the check).
8.5.17
- Fixed
Maximum call stack size exceeded error.
- Fixed Prototype hijacking for
postcss.fromJSON().
- Fixed
Input#origin() for unmapped end position (by @chatman-media).
Changelog
Sourced from postcss's changelog.
8.5.23
- Do not load source map without
opts.from for security reasons.
8.5.22
8.5.21
8.5.20
8.5.19
- Fixed cleaning
before for new nodes inserted to Root (by @MahinAnowar).
8.5.18
- Restricted loading previous source maps file to the
opts.from folder for security reasons (use unsafeMap: true to disable the check).
8.5.17
- Fixed
Maximum call stack size exceeded error.
- Fixed Prototype hijacking for
postcss.fromJSON().
- Fixed
Input#origin() for unmapped end position (by @chatman-media).
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page [QUARANTINED_URL: github.com].
Bumps the npm_and_yarn group with 2 updates in the / directory: js-yaml [QUARANTINED_URL: github.com] and postcss [QUARANTINED_URL: github.com].
Updates
js-yamlfrom 5.2.1 to 5.2.2Changelog
Sourced from js-yaml's changelog.
Commits
3c295595.2.2 released3e5240fparser: avoid reparsing flow sequence pair keysbd7ebb2fix: quote flow scalars where a colon precedes a flow indicator (#773)Updates
postcssfrom 8.5.16 to 8.5.23Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
eb9e1feRelease 8.5.23 version9d19c78Update dependencies7beca13Does no load source map file without opts.fromdecea51Typoc18e30dUpdate EM banner98a39adUpdate EM bannera3e48c4Release 8.5.22 versionf49d691Fix custom property losing its semicolon before a comment (#2117)28e0dafRelease 8.5.21 version3d2b4e4Update dependenciesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the Security Alerts page [QUARANTINED_URL: github.com].