Skip to content

Bump js-yaml and gulp-imagemin in /src/main/content/antora_ui#4282

Closed
dependabot[bot] wants to merge 1 commit into
prodfrom
dependabot/npm_and_yarn/src/main/content/antora_ui/multi-87e1cee6b2
Closed

Bump js-yaml and gulp-imagemin in /src/main/content/antora_ui#4282
dependabot[bot] wants to merge 1 commit into
prodfrom
dependabot/npm_and_yarn/src/main/content/antora_ui/multi-87e1cee6b2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 17, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml and gulp-imagemin. These dependencies needed to be updated together.
Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3
Commits

Updates gulp-imagemin from 7.1.0 to 9.2.0

Release notes

Sourced from gulp-imagemin's releases.

v9.2.0

  • Allow optimizing WebP images (#393) 4aeb145

sindresorhus/gulp-imagemin@v9.1.0...v9.2.0

v9.1.0

  • Update dependencies 127615e

sindresorhus/gulp-imagemin@v9.0.0...v9.1.0

v9.0.0

Breaking

  • Require Node.js 18 70e07e8

sindresorhus/gulp-imagemin@v8.0.0...v9.0.0

v8.0.0

sindresorhus/gulp-imagemin@v7.1.0...v8.0.0

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 17, 2026
Bumps [js-yaml](https://github.com/nodeca/js-yaml) and [gulp-imagemin](https://github.com/sindresorhus/gulp-imagemin). These dependencies needed to be updated together.

Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `gulp-imagemin` from 7.1.0 to 9.2.0
- [Release notes](https://github.com/sindresorhus/gulp-imagemin/releases)
- [Commits](sindresorhus/gulp-imagemin@v7.1.0...v9.2.0)

---
updated-dependencies:
- dependency-name: gulp-imagemin
  dependency-version: 9.2.0
  dependency-type: direct:development
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/src/main/content/antora_ui/multi-87e1cee6b2 branch from cb1f078 to 495f59f Compare June 18, 2026 18:31
@dependabot @github

dependabot Bot commented on behalf of github Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #4291.

@dependabot dependabot Bot closed this Jul 9, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/src/main/content/antora_ui/multi-87e1cee6b2 branch July 9, 2026 06:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants