Bump the npm-security group across 1 directory with 4 updates by dependabot[bot] · Pull Request #52 · MrTig-afk/MingleHub

dependabot · 2026-09-02T08:50:10Z

Bumps the npm-security group with 3 updates in the /frontend directory: postcss, brace-expansion and fast-uri.

Updates postcss from 8.5.15 to 8.5.26

Release notes

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

... (truncated)

Commits

07b2577 Release 8.5.26 version
47de6b9 Update CI
1493a83 Fix Rule#selectors losing the empty selector (#2129)
180db16 Typo
29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
3ba8f84 Update dependencies
87e72f6 Update lock file
caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
3609b6f Explain how to type plugin options
fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates brace-expansion from 2.1.1 to 2.1.4

Commits

b25213d 2.1.4
1e30c93 Merge commit from fork
878df39 2.1.3
c8bd93c npm ignore .claude
d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
9e67a3b 2.1.2
835d6be fix: v2 backport for CVE-2026-13149 (#123)
See full diff in compare view

Updates fast-uri from 3.1.2 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
ae92a4c Merge commit from fork
444ecda Merge commit from fork
Additional commits viewable in compare view

Updates nanoid from 3.3.14 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

Changelog

Sourced from nanoid's changelog.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

Commits

9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
ba0bc3b Do not create latest release for v3
6819724 Release 3.3.15 version
Additional commits viewable in compare view

vercel · 2026-09-02T08:50:15Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mingle-hub	Ready	Preview	Sep 3, 2026 3:36am UTC

Bumps the npm-security group with 3 updates in the /frontend directory: [postcss](https://github.com/postcss/postcss), [brace-expansion](https://github.com/juliangruber/brace-expansion) and [fast-uri](https://github.com/fastify/fast-uri). Updates `postcss` from 8.5.15 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.26) Updates `brace-expansion` from 2.1.1 to 2.1.4 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.1...v2.1.4) Updates `fast-uri` from 3.1.2 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.7) Updates `nanoid` from 3.3.14 to 3.3.18 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.14...3.3.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 2.1.4 dependency-type: indirect dependency-group: npm-security - dependency-name: fast-uri dependency-version: 3.1.6 dependency-type: indirect dependency-group: npm-security - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect dependency-group: npm-security - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development dependency-group: npm-security ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 2, 2026

dependabot Bot mentioned this pull request Sep 2, 2026

Bump nanoid from 3.3.14 to 3.3.18 in /frontend #35

Closed

This was referenced Sep 2, 2026

Bump brace-expansion in /frontend #37

Closed

Bump fast-uri from 3.1.2 to 3.1.5 in /frontend #38

Closed

vercel Bot deployed to Preview September 2, 2026 08:52 View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/npm-security-c4bcd5c682 branch from 505ca1b to 8344378 Compare September 3, 2026 03:35

vercel Bot deployed to Preview September 3, 2026 03:36 View deployment

Navigation Menu

Bump the npm-security group across 1 directory with 4 updates - #52

Bump the npm-security group across 1 directory with 4 updates#52
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/npm-security-c4bcd5c682

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

3.3.18

3.3.17

3.3.16

3.3.15

3.3.18

3.3.17

3.3.16

3.3.15

Uh oh!

vercel Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading

vercel Bot commented Sep 2, 2026 •

edited

Loading