build(deps-dev): bump the npm_and_yarn group across 1 directory with 3 updates by dependabot[bot] · Pull Request #57 · MadeInPierre/cuicuit

dependabot · 2026-09-02T07:44:43Z

Bumps the npm_and_yarn group with 3 updates in the / directory: postcss, js-yaml and postcss-selector-parser.

Updates postcss from 8.5.16 to 8.5.28

Release notes

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

Changelog

Sourced from postcss's changelog.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

... (truncated)

Commits

e544bff Release 8.5.28 version
f8fc252 Typo
5039fd7 Add missed release notes
ae40ca4 Release 8.5.27 version
62b1626 Fix linter
1dba938 Update dependencies
3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
6d23bc3 Fix link
508e997 Add GitHub Sponsors link
e993739 Add CodeRabbit sponsor (#2145)
Additional commits viewable in compare view

Updates js-yaml from 4.3.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
See full diff in compare view

Updates postcss-selector-parser from 6.1.2 to 6.1.4

Release notes

Sourced from postcss-selector-parser's releases.

6.1.4

fix: tolerate non-node children when serializing selectors

6.1.3

Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 via backport of (#316 by @MoOx)

Changelog

Sourced from postcss-selector-parser's changelog.

Changelog of postcss-selector-parser

7.1.6 - 2026-09-03

fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

fix: don't treat a non-prefix token before | as a namespace (#324 by @spokodev)

fix: preserve whitespace before a * namespace in attribute selectors (#325 by @spokodev)

fix: TypeError on unclosed [, ( and trailing | (#330 by @theRizwan)

7.1.4 - 2026-06-11

fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @MoOx)

7.1.1

perf: replace startsWith with strict equality (#308)

fix(types): add walkUniversal declaration (#311)

7.1.0

feat: insert(Before|After) support multiple new node

7.0.0

Feat: make insertions during iteration safe (major)

Commits

4a7e4e3 7.1.4
e2021c5 fix: tolerate non-node children when serializing selectors
7893b74 7.1.3
5bc698c Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clo...
db32327 run oxfmt
16e2581 simplify deps (#319)
b185e20 Add description in package.json + full repo url
de415f1 Add Tidelift security notice
c4f2c8c CI: make Node 14 test job lockfile-v3 compatible (#318)
4e93663 Fix test run on node < 20
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

vercel · 2026-09-02T07:44:46Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cuicuit	Ready	Preview	Sep 6, 2026 3:36pm UTC

…3 updates Bumps the npm_and_yarn group with 3 updates in the / directory: [postcss](https://github.com/postcss/postcss), [js-yaml](https://github.com/nodeca/js-yaml) and [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser). Updates `postcss` from 8.5.16 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.16...8.5.28) Updates `js-yaml` from 4.3.0 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) Updates `postcss-selector-parser` from 6.1.2 to 6.1.4 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v6.1.2...6.1.4) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development - dependency-name: postcss-selector-parser dependency-version: 6.1.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 2, 2026

github-project-automation Bot added this to Cuicuit project Sep 2, 2026

github-project-automation Bot moved this to 🆕 New in Cuicuit project Sep 2, 2026

vercel Bot deployed to Preview September 2, 2026 07:45 View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-5559489bf4 branch from ad7a4b8 to 71d43b5 Compare September 6, 2026 15:35

vercel Bot deployed to Preview September 6, 2026 15:36 View deployment

Navigation Menu

Uh oh!

build(deps-dev): bump the npm_and_yarn group across 1 directory with 3 updates - #57

build(deps-dev): bump the npm_and_yarn group across 1 directory with 3 updates#57
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-5559489bf4

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

4.3.2 - 2026-08-26

Changed

Security

4.3.1 - 2026-07-31

Security

6.1.4

6.1.3

Changelog of postcss-selector-parser

7.1.6 - 2026-09-03

7.1.5 - 2026-08-07

7.1.4 - 2026-06-11

7.1.3 - 2026-06-11

7.1.2 - 2026-06-09

7.1.1

7.1.0

7.0.0

Uh oh!

vercel Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading

Changelog of `postcss-selector-parser`

vercel Bot commented Sep 2, 2026 •

edited

Loading