🚨 [security] [js] Update stylelint 17.14.1 → 17.15.0 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ stylelint (17.14.1 → 17.15.0) · Repo · Changelog

Release Notes

17.15.0

It adds 1 new rule and 2 new rule options, and fixes 4 bugs.

• Added: selector-no-unmatchable rule (#9451) (@jeddy3).
• Added: ignoreFunctions: [] to color-named and color-no-hex (#9463) (@jsmitty12).
• Fixed: custom-property-no-missing-var-function false positives for anchor positioning (#9466) (@giaBaoJS).
• Fixed: declaration-block-no-redundant-longhand-properties autofix for font shorthand (#9402) (@sarathfrancis90).
• Fixed: declaration-property-max-values false positives for interpolated inline expressions (#9437) (@alexchen-sys).
• Fixed: selector-no-invalid false negatives for pseudo-elements, combinators and nested :has() (#9452) (@jeddy3).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 56 commits:

• Release 17.15.0 (#9484)
• Fix `custom-property-no-missing-var-function` false positives for anchor positioning (#9466)
• Bump @humanfs/node from 0.16.6 to 0.16.8 (#9480)
• Bump fast-uri from 3.1.5 to 3.1.7 (#9481)
• Bump the jest group across 1 directory with 2 updates (#9476)
• Bump browserslist from 4.28.4 to 4.28.8 (#9479)
• Add `ignoreFunctions: []` to `color-named` and `color-no-hex` (#9463)
• Bump postcss-import from 16.1.1 to 16.2.0 in the postcss group (#9477)
• Bump globby from 16.2.3 to 16.2.4 (#9478)
• Bump @csstools/css-syntax-patches-for-csstree from 1.1.8 to 1.1.9 in the csstree group (#9474)
• Bump the eslint group with 2 updates (#9475)
• Fix `selector-no-invalid` false negatives for pseudo-elements, combinators and nested `:has()` (#9452)
• Fix `declaration-property-max-values` false positives for interpolated inline expressions (#9437)
• Add `selector-no-unmatchable` (#9451)
• Bump string-width from 8.2.1 to 8.2.2 (#9462)
• Bump colord from 2.9.3 to 2.10.0 (#9461)
• Bump eslint from 10.8.1 to 10.9.0 in the eslint group (#9459)
• Bump @changesets/cli from 3.0.0 to 3.0.1 in the changesets group (#9458)
• Add `--source` and `--config` options to rule benchmark script (#9455)
• Document `referenceFiles` more prominently in customising guide (#9454)
• Bump tinybench from 6.0.2 to 6.1.3 (#9449)
• Bump @csstools/css-syntax-patches-for-csstree from 1.1.7 to 1.1.8 in the csstree group (#9446)
• Bump npm-run-all2 from 9.0.2 to 9.0.3 (#9448)
• Bump vulnerable packages via `npm audit fix` (#9444)
• Bump the changesets group with 2 updates (#9440)
• Bump the eslint group across 1 directory with 2 updates (#9441)
• Bump the postcss group with 3 updates (#9442)
• Bump globby from 16.2.2 to 16.2.3 (#9443)
• Bump the typescript group across 1 directory with 2 updates (#9432)
• Respect default cooldown period for Dependabot (#9439)
• Bump the eslint group with 2 updates (#9431)
• Bump lint-staged from 17.0.8 to 17.3.0 (#9434)
• Bump globby from 16.2.1 to 16.2.2 (#9435)
• Bump prettier from 3.9.5 to 3.9.6 (#9417)
• Bump @changesets/cli from 2.31.0 to 2.31.1 in the changesets group across 1 directory (#9414)
• Bump fast-uri from 3.1.4 to 3.1.5 (#9430)
• Bump postcss from 8.5.21 to 8.5.25 (#9429)
• Bump @csstools/css-syntax-patches-for-csstree from 1.1.6 to 1.1.7 in the csstree group across 1 directory (#9428)
• Bump the csstools-parser group with 2 updates (#9427)
• Document "ready to implement" label in the contributing guide (#9425)
• Fix unknown effort workflow (#9421)
• Bump actions/checkout from 7.0.0 to 7.0.1 (#9413)
• Bump eslint-plugin-jest from 29.15.4 to 29.15.5 in the eslint group (#9415)
• Bump postcss from 8.5.19 to 8.5.21 in the postcss group (#9416)
• Fix `declaration-block-no-redundant-longhand-properties` autofix for `font` shorthand (#9402)
• Bump the stylelint-actions group with 5 updates (#9403)
• Bump fast-uri from 3.1.2 to 3.1.4 (#9410)
• Bump shell-quote from 1.8.4 to 1.10.0 (#9411)
• Bump actions/setup-node from 6.4.0 to 7.0.0 (#9404)
• Bump eslint from 10.6.0 to 10.7.0 in the eslint group (#9405)
• Bump postcss from 8.5.16 to 8.5.19 in the postcss group (#9406)
• Bump prettier from 3.9.4 to 3.9.5 (#9409)
• Bump ignore from 7.0.5 to 7.0.6 (#9408)
• Document summary and item order of latest release in CHANGELOG (#9401)
• Fix doubled periods in CHANGELOG.md entries (#9399)
• Use `node-version: latest` instead of `lts/*` for `actions/setup-node` (#9398)

↗️ colord (indirect, 2.9.3 → 2.10.0) · Repo · Changelog

Release Notes

2.10.0 (from changelog)

• Improve mix plugin by adding an optional "rgb" interpolation mode to mix, tints, tones and shades

2.9.7 (from changelog)

• Make HEX parsing and serialization more than 2x faster

2.9.6 (from changelog)

• Fix: Rotate the unrounded hue so rotate and harmonies preserve the original color
• Fix: Normalize HWB whiteness + blackness over 100% to gray ❤️ @spokodev

2.9.5 (from changelog)

• Fix: Use adjusted chroma for the CIEDE2000 rotation term ❤️ @maximilliangrand
• Fix: Keep the hue within [0, 360) in every color model ❤️ @sarathfrancis90

Both fixes change returned numbers for a small set of colors; toHex() output is unchanged. Snapshots holding h: 360, "hsl(360, …)" or a delta() value may need updating.

2.9.4 (from changelog)

• Fix: Reject malformed color strings in linear time ❤️ @GAP-dev

Does any of this look wrong? Please let us know.

↗️ fastq (indirect, 1.20.1 → 1.20.3) · Repo

Release Notes

1.20.3

Full Changelog: v1.20.2...v1.20.3

1.20.2

What's Changed

• fix: preserve running count when aborting queued tasks by @mcollina in #107

Full Changelog: v1.20.1...v1.20.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 3 commits:

• Bumped v1.20.3
• Bumped v1.20.2
• fix: preserve running count when aborting queued tasks (#107)

↗️ globby (indirect, 16.2.1 → 16.2.4) · Repo

Release Notes

16.2.4

• Fix ignore option disabling the gitignore option 19e1fce

---

v16.2.3...v16.2.4

16.2.3

• Fix backslash-escaped .gitignore rules 5775ffb

---

v16.2.2...v16.2.3

16.2.2

• Fix: Do not enumerate ignored directories with gitignore option 8bf8f54

---

v16.2.1...v16.2.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

• 16.2.4
• Fix `ignore` option disabling the `gitignore` option
• 16.2.3
• Fix backslash-escaped `.gitignore` rules
• Meta tweaks
• 16.2.2
• Fix: Do not enumerate ignored directories with `gitignore` option

↗️ nanoid (indirect, 3.3.16 → 3.3.18) · Repo · Changelog

Security Advisories 🚨

🚨 nanoid: custom generators can loop indefinitely when size is zero

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Release Notes

3.3.18

• Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Release 3.3.18 version
• Update CI action
• Update index.native.js (#606)
• Release 3.3.17 version
• Sync 0 size behaviour with PostCSS 5

↗️ postcss (indirect, 8.5.23 → 8.5.28) · Repo · Changelog

Release Notes

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @Jaybhade).
• Fixed empty values in the middle of list.comma() (by @MahinAnowar).
• Fixed whitespace-only values in list.space() (by @MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @maximilliangrand).
• Fixed types (by @romainmenke).
• Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

• Fixed list.split() regression (by @lazerg).
• Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @hdimer).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 35 commits:

• Release 8.5.28 version
• Typo
• Add missed release notes
• Release 8.5.27 version
• Fix linter
• Update dependencies
• Keep non-annotation comments when the processor has no plugins (#2150)
• Fix link
• Add GitHub Sponsors link
• Add CodeRabbit sponsor (#2145)
• Fix chinese print not work (#2144)
• Drop whitespace-only values from list.space() (#2141)
• Fix `'source' does not exist in type 'DeclarationProps'` error (#2138)
• Update dependencies
• Fix rule end offset when spaces precede its own semicolon (#2135)
• Keep empty values in the middle and at the start of list.comma() (#2134)
• Do not terminate a hack-prefixed property before a comment (#2126)
• Release 8.5.26 version
• Update CI
• Fix Rule#selectors losing the empty selector (#2129)
• Typo
• Resolve symlinks before the previous-source-map containment check (#2125)
• Update dependencies
• Update lock file
• Upgrade nanoid to fix infinite loop on zero size (#2124)
• Explain how to type plugin options
• docs: show ESM and TypeScript plugin declaration (#2118)
• Release 8.5.25 version
• Fix 8.5.17 visitor regression
• Add supply chain security requirement to PostCSS plugin guide
• fix: return empty array for empty string in list.split (#2121)
• Release 8.5.24 version
• Update dependencies
• Preserve the BOM when stringifying (#2119)
• Fix types check

↗️ postcss-selector-parser (indirect, 7.1.4 → 7.1.6) · Repo · Changelog

Release Notes

7.1.6

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

• fix: don't treat a non-prefix token before | as a namespace (#324 by @spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @theRizwan)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 8 commits:

• 7.1.6
• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
• 7.1.5
• fix: TypeError on unclosed `[`, `(` and trailing `|` (#330)
• fix: preserve whitespace before a `*` namespace in attribute selectors (#325)
• fix: don't treat a non-prefix token before `|` as a namespace (#324)
• chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
• chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)

🆕 ignore (added, 7.0.8)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)