chore(deps): bump the npm_and_yarn group across 2 directories with 21 updates

[dependabot]

Bumps the npm_and_yarn group with 12 updates in the / directory:

Package	From	To
postcss	8.5.6	8.5.30
dompurify	3.3.1	3.4.17
brace-expansion	1.1.12	1.1.21
baseline-browser-mapping	2.9.8	2.11.29
browserslist	4.28.1	4.29.3
decode-uri-component	0.2.2	0.5.0
ip-address	10.1.0	10.7.4
js-yaml	3.14.2	3.15.2
nanoid	3.3.11	3.3.20
source-map-js	1.2.1	1.2.2
sprintf-js	1.0.3	removed
ws	8.18.3	8.22.0

Bumps the npm_and_yarn group with 11 updates in the /website directory:

Package	From	To
postcss	8.5.6	8.5.30
ws	7.5.10	7.5.13
@babel/core	7.28.5	7.29.7
body-parser	1.20.4	1.20.8
http-cache-semantics	4.2.0	4.3.0
http-proxy-middleware	2.0.9	2.0.10
launch-editor	2.12.0	2.14.2
node-forge	1.3.3	removed
webpack-dev-server	5.2.2	5.2.6
shell-quote	1.8.3	1.12.0
webpack-dev-server	5.2.2	5.2.6
websocket-driver	0.7.4	0.7.5

Updates postcss from 8.5.6 to 8.5.30

Release notes

Sourced from postcss's releases.

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

... (truncated)

Commits

• f1aca7e Release 8.5.30 version
• 9d83445 Update dependencies
• 6c9bc73 Fix invalid source map mapping on escaping before new line (#2169)
• 1fd8f88 Add missed changes in changelog
• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• 7ac9026 Do not split list.comma() and list.space() on separators inside comments (#2162)
• ebffa97 Add postcss-smooth-corners plugin
• 57d6401 Speed up source map cleaning
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates dompurify from 3.3.1 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

• Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
• Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
• Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
• Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
• Added a purify-edge test runner as a compatibility check, thanks @​anzal1
• Clarified the IN_PLACE documentation in the README about possible risks
• Updated several dependencies

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

... (truncated)

Commits

• a77a3e7 release: 3.4.17 (#1672)
• b9b9d80 release: 3.4.16 (#1636)
• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates brace-expansion from 1.1.12 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.9.8 to 2.11.29

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

• feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
• refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
• refactor: Some common functions have been moved to a util.ts module for use in other scripts.
• fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.0

What's Changed

• Introduces support for Node 6 by refactoring all Object.entries and Object.values instances and lowering ES target in Rollup to es2015.
• Adds specified Node version support in package.json for >=6.0.0.
• Refactors CLI code to avoid parseArgs which is not supported by versions of Node prior to 18, changes import to require and changes Rollup export to cjs to allow execution on older versions of Node.
• Adds a new legacy-test.js file that allows basic testing on older versions of Node where current versions of Jasmine and ESLint are not supported.
• Adds a test matrix to run tests on all even-numbered Node versions from 6 to 24.
• refactor publish workflows to support NPM's new OIDC integration

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.24...v2.10.0

Commits

• c9ca998 Patch to 2.11.29 because browser or feature data changed
• 2f35299 Browser or feature data changed
• 517a1bf Updating static site
• 17963c0 Patch to 2.11.28 because browser or feature data changed
• 5d628d8 Browser or feature data changed
• 18ccb38 Updating static site
• 6141d06 Patch to 2.11.27 because browser or feature data changed
• e1d166b Browser or feature data changed
• 42972a7 Updating static site
• c1934c6 Patch to 2.11.26 because browser or feature data changed
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for baseline-browser-mapping since your current version.

Updates browserslist from 4.28.1 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

Changelog

Sourced from browserslist's changelog.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improved or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

... (truncated)

Commits

• b4809dd Release 4.29.3 version
• 9d844f8 Update Firefox ESR
• 0033f34 Update dependencies
• 906d329 Release 4.29.2 version
• ff8c83f Update dependencies
• 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
• f760921 Do not add versions without usage data to cover queries
• 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
• 1e5356f Note that Android version queries return only the latest version
• 5b7e941 Add missed changes to ChangeLog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates decode-uri-component from 0.2.2 to 0.5.0

Release notes

Sourced from decode-uri-component's releases.

v0.5.0

• Rewrite decoder as single-pass UTF-8 scanner and expand tests fa479da
• Fix ci and tests 38bdbec
• Add sideEffects: false to package.json 89446f9

SamVerschueren/decode-uri-component@v0.4.1...v0.5.0

v0.4.1

• Add TypeScript type definitions c345b4c

SamVerschueren/decode-uri-component@v0.4.0...v0.4.1

v0.4.0

• Require Node.js 14 and move to ESM (#11) b09e39d

SamVerschueren/decode-uri-component@v0.3.0...v0.4.0

v0.3.0

• Do not decode + to a space - fixes #3 3bbc879

SamVerschueren/decode-uri-component@v0.2.2...v0.3.0

Commits

• a12faba 0.5.0
• fa479da Rewrite decoder as single-pass UTF-8 scanner and expand tests
• 38bdbec Fix ci and tests
• 89446f9 Add sideEffects: false to package.json (#23)
• 0066293 0.4.1
• c345b4c Add TypeScript type definitions
• b3710c4 0.4.0
• b09e39d Require Node.js 14 and move to ESM (#11)
• 7268ef6 0.3.0
• 3bbc879 Do not decode + to a space - fixes #3
• See full diff in compare view

Updates ip-address from 10.1.0 to 10.7.4

Release notes

Sourced from ip-address's releases.

v10.7.4

Full Changelog: beaugunderson/ip-address@v10.7.3...v10.7.4

v10.7.3

What's Changed

• Reject an in-addr.arpa name longer than 32 characters before splitting it by @​beaugunderson in beaugunderson/ip-address#228

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

v10.7.2

What's Changed

• Accept an arpa suffix in any case and without the root dot in fromArpa by @​beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

• Bump js-yaml and brace-expansion in the lockfile by @​beaugunderson in beaugunderson/ip-address#226

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

What's Changed

• Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @​beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

• Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @​beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

• Honor the fromURL graceful-failure contract for non-IPv6 hosts by @​beaugunderson in beaugunderson/ip-address#218
• Correct the documentation where it disagreed with the library by @​beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

... (truncated)

Commits

• 651c1dd 10.7.4
• ec80fcd Find an IPv6 zone by index so a rejected zone costs one pass
• e22eb4a Check generated docs without writing or hiding partial staging
• c7f838e 10.7.3
• 09b8072 Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)
• 974b48d 10.7.2
• 4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
• f0c25df 10.7.1
• 8b34a21 Merge commit from fork
• 13b6155 Merge commit from fork
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

Commits

• 5c45bd6 3.15.2 released
• 5a708f9 dist rebuild
• 3485bc0 Backport merge limits from v5.4.1
• f34812f Update .gitignore
• ab85ae2 3.15.1 released
• 30a5e76 dist rebuild
• 22a8071 Backport quadratic complexity fix for !!omap
• c34b6c4 3.15.0 released
• 21e13d3 dist rebuild
• 4165c62 Add v3-legacy tag for publish
• Additional commits viewable in compare view

Updates nanoid from 3.3.11 to 3.3.20

Release notes

Sourced from nanoid's releases.

3.3.20

• Fixed types (by @​johnemau).

3.3.19

• Fixed killing the app by setting huge user ID.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

3.3.16

• Fixed infinite loop on negative size (by @​greymoth-jp).

3.3.15

• Fixed npm provenance error.

3.3.14

• Fixed random pool corruption on big ID sizes.

3.3.13

• Reduced npm package size.

3.3.12

• Fixed breaking Nano ID by requesting big ID.

Changelog

Sourced from nanoid's changelog.

3.3.20

• Fixed types (by @​johnemau).

3.3.19

• Fixed killing the app by setting huge user ID (by @​geoffrey-diederichs).

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

3.3.16

• Fixed infinite loop on negative size (by @​greymoth-jp).

3.3.15

• Fixed npm provenance error.

3.3.14

• Fixed random pool corruption on big ID sizes.

3.3.13

• Reduced npm package size.

3.3.12

• Fixed breaking Nano ID by requesting big ID.

Commits

• d76f633 Release 3.3.20 version
• ac09ff6 Fix: async return types are synchronous in v3 (#615)
• eb63bd6 Release 3.3.19 version
• 9067e03 Sync CJS and ESM
• 9ad9805 Release 3.3.18 version
• 55e50a0 Update CI action
• e10f8d4 Update index.native.js (#606)
• 73d6716 Release 3.3.17 version
• f9d13f1 Sync 0 size behaviour with PostCSS 5
• 9760e11 Release 3.3.16 version
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Commits

• 0a1d334 1.2.2
• 4c6fa26 Update changelog
• cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
• 7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
• See full diff in compare view

Removes sprintf-js

Updates ws from 8.18.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

• Introduced the protocols option (8b918b01).

Bug fixes

• Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
</tr></table>

... (truncated)

Commits

• 297202c [dist] 8.22.0
• 8b918b0 [feature] Introduce the protocols option
• 73e03eb [ci] Update actions/setup-node action to v7
• d9b8954 [fix] Change the ready state after validating the arguments (#2337)
• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.30

Release notes

Sourced from postcss's releases.

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

Description has been truncated

[dependabot]

Looks like these dependencies are no longer a dependency, so this is no longer needed.