Bump form-data and juice

[dependabot]

Removes form-data. It's no longer used after updating ancestor dependency juice. These dependencies need to be updated together.

Removes form-data

Updates juice from 5.2.0 to 12.1.1

Release notes

Sourced from juice's releases.

v12.1.1

• build(deps-dev): bump vitest from 4.1.8 to 4.1.9 29e9e67
• build(deps): bump postcss-selector-parser from 7.1.1 to 7.1.4 a988791
• build(deps-dev): bump @​types/node from 25.9.2 to 25.9.3 9baacd5

---

Automattic/juice@v12.1.0...v12.1.1

v12.1.0

• feat: add data-juice-important attribute 7cb46ac

---

Automattic/juice@v12.0.0...v12.1.0

v12.0.0

Juice 12

Modernizes the entire stack: ESM-only, PostCSS-based parsers to support CSS Nesting + spec-correct selector specificity, Node 22.12+ floor, Vitest 4.

Breaking changes

• Juice is now ESM-only. CJS consumers on Node ≥ 22.12 keep working transparently via Node's built-in require(esm) interop. Older Node versions need to upgrade.
• Node ≥ 22.12.0 required. Drops support for Node 18 and Node 20. CI matrix is now Node 22, 24, 26.
• Browser: client.js is ESM. Modern bundlers (Vite, webpack 5, esbuild, Rollup, Parcel 2+) handle it via the "browser" condition in the exports map. Browserify is no longer supported, it cannot parse ESM. README updated to point at modern bundlers.
• CSS parser swapped: mensch → postcss + postcss-safe-parser. Selector parser swapped: slick → postcss-selector-parser. Both old libs were unmaintained since 2022. Inlining semantics unchanged; preserved-CSS output inside <style> blocks is now canonically formatted (mensch had quirks like ;} squashed onto one line). 4 fixture .out files refreshed to match.
• Spec-correct selector specificity for :is(), :where(), :has(), :not() per CSS Selectors Level 4: :where(...) contributes 0, the others contribute max(spec(args)). Previously juice treated all four as a generic :pseudo and :not used "first arg only" (a slick legacy). Any cascade resolution that depended on the old quirks will produce different inlined styles.
• commander upgraded to v14, entities upgraded to v8 (ESM-only), cheerio pinned to 1.2.0.
• TypeScript declarations renamed juice.d.ts → index.d.ts and restructured for ESM default-export resolution. Import as import juice from 'juice'.

New features

• CSS Nesting (Level 1) is supported. Nested rules (.card { &:hover { ... } }), nested at-rules (.card { @media (...) { ... } }), the & parent selector, and bare nested selectors (per the 2023 CSSWG resolution) are flattened via postcss-nesting before inlining. Previously these were silently dropped. No behavior change for already-flat CSS.
• @container and @layer at-rules are preserved through inlining (mirrors how @media/@font-face/@keyframes already worked). New options preserveContainerQueries and preserveLayers default to true.
• Long-standing crashes/hangs in :not(a, b, …) are gone as a side effect of the parser swap — the underlying causes of #390, #471, and #398 were quirks in mensch/slick that don't exist in postcss.
• TypeScript types ship via the types condition in exports and resolve correctly under nodenext module resolution.

Tooling

• Test runner: Mocha → Vitest 4 with @vitest/coverage-v8. New scripts: npm test, npm run test:watch, npm run coverage. The previously broken testcover script is gone.
• CLI extraction: bin/juice's logic moved into lib/cli.js as a testable cli.run(argv, deps) with dependency injection. The bin itself is now a 3-line ESM shim.
• Test files renamed: cli.js → cli.test.js, test.js → integration.test.js, run.js → cases.test.js. TypeScript test now uses a dedicated test/typescript/tsconfig.json with nodenext resolution.
• Test assertions migrated from Node's assert to Vitest's expect: better failure diffs, more matchers, idiomatic.
• Removed devDependencies: mocha, should, batch, browserify. Added: vitest, @vitest/coverage-v8, postcss, postcss-safe-parser, postcss-selector-parser, postcss-nesting.

Migration notes

Scenario	Action needed

... (truncated)

Changelog

Sourced from juice's changelog.

Unreleased

Breaking changes

• Juice is now ESM-only. Consumers using require('juice') from CJS on Node ≥ 22.12 will continue to work via Node's built-in require(esm) interop. CJS consumers on older Node versions will need to migrate to import or upgrade Node.
• Node ≥ 22.12.0 required. Dropped support for Node 18 and Node 20. CI now runs on Node 22, 24, and 26.
• Browser: the package's client.js entry is now ESM. Modern bundlers (Vite, webpack 5, esbuild, Rollup, Parcel 2+) handle it transparently via the "browser" condition in exports. Browserify is no longer supported — it cannot parse ESM.
• CSS parser replaced: mensch → postcss + postcss-safe-parser. Selector parser replaced: slick → postcss-selector-parser. Both old libs were unmaintained since 2022 and mis-handled modern CSS. Inlining behaviour is unchanged; preserved-CSS output inside <style> blocks is now canonically formatted (fixes mensch quirks like ;} squashed on one line and 0%,\n100% selector splits).
• Specificity is now spec-correct for :is(), :where(), :has(), and :not() (CSS Selectors Level 4). :where(...) contributes 0; :is(...), :has(...), and :not(...) contribute the maximum specificity across their arguments. Previously juice treated all four as a generic :pseudo and :not used "first argument only" (a slick legacy). Any cascade resolution that depended on the old quirks will produce different inlined styles.
• @container and @layer at-rules are now preserved through inlining (mirroring @media / @font-face / @keyframes). New options preserveContainerQueries and preserveLayers default to true; pass false to drop them. Note: @layer is preserved verbatim only — layer-aware cascade resolution is not implemented (email clients don't support layers anyway).
• CSS Nesting is now supported. Nested rules (.card { &:hover { ... } }), nested at-rules (.card { @media (min-width: 600px) { ... } }), and the & parent selector are flattened via postcss-nesting before inlining. Previously, nested rules were silently dropped during parsing. No behaviour change for already-flat CSS.
• commander upgraded to v14. Positional CLI arguments are now declared explicitly via .argument() (commander v14 errors on excess undeclared args).
• entities upgraded to v8 (ESM-only).
• cheerio pinned to 1.2.0.
• TypeScript declarations renamed juice.d.ts → index.d.ts and restructured for ESM default-export resolution (import juice from 'juice').
• Test runner migrated from Mocha to Vitest 4.

Tooling

• npm test now runs vitest run --coverage && npm run test-typescript.
• New npm run coverage script using @vitest/coverage-v8 (replaces the previously broken testcover script).
• New npm run test:watch for interactive development.
• Test files renamed: test/cli.js → test/cli.test.js, test/test.js → test/integration.test.js, test/run.js → test/cases.test.js.
• bin/juice extracted: the CLI logic now lives in lib/cli.js as a testable cli.run(argv, deps) function with dependency injection. The bin itself is a 3-line ESM shim.
• TypeScript test now uses a dedicated test/typescript/tsconfig.json with nodenext module resolution.
• Removed devDependencies: mocha, should, batch, browserify. Added: vitest, @vitest/coverage-v8.
• package.json now declares "type": "module" and an "exports" map with types / browser / default conditions.

11.1.1 / 2026-02-04

• fix: data-embed style tags db64a51
• build(deps): bump entities from 7.0.0 to 7.0.1 476d286
• build(deps-dev): bump @​types/node from 25.0.10 to 25.2.0 306ceb7

11.1.0 / 2026-01-05

New features

• juice ignore CSS comments ce49f21
• removeInlinedSelectors 130184e
• inline duplicate properties c5b78ae
• preservedSelectors option fbd82ca

11.0.3 / 2025-09-30

We are now pinning the cheerio dependency to v1.0.0 so that we can keep supporting Node 18.

To anyone affected by the cheerio breaking change that should have been a major version release, sorry! Moving forward, for as long as we rely on cheerio we will pin it to a fixed version that we make sure does not silently introduce breaking changes in patch releases.

11.0.2 / 2025-09-29

... (truncated)

Commits

• 46cbc51 12.1.1
• 485e623 Merge pull request #624 from Automattic/dependabot/npm_and_yarn/vitest-4.1.9
• a7f4f8f Merge pull request #623 from Automattic/dependabot/npm_and_yarn/postcss-selec...
• 1c5e3e2 Merge pull request #622 from Automattic/dependabot/npm_and_yarn/types/node-25...
• 29e9e67 build(deps-dev): bump vitest from 4.1.8 to 4.1.9
• a988791 build(deps): bump postcss-selector-parser from 7.1.1 to 7.1.4
• 9baacd5 build(deps-dev): bump @​types/node from 25.9.2 to 25.9.3
• 44160a3 Merge pull request #621 from Automattic/dependabot/npm_and_yarn/types/node-25...
• 8d1734b build(deps-dev): bump @​types/node from 25.9.1 to 25.9.2
• 54c05d2 12.1.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by cossssmin, a new releaser for juice since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.