chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates by dependabot[bot] · Pull Request #65 · mgifford/drupal-core

dependabot · 2026-09-02T13:23:12Z

Bumps the npm_and_yarn group with 3 updates in the /core directory: browserslist, nanoid and postcss-selector-parser.

Updates browserslist from 4.24.5 to 4.28.8

Release notes

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Fixed throwOnMissing with extends query (by @alexander-akait).

4.26.2

Fixed baseline-browser-mapping version requirement.

4.26.1

Updated Firefox ESR.

4.26.0

Added Baseline queries (by @tonypconway).

4.25.4

Fixed Windows support for custom stats (by @torgeilo).

4.25.3

Fixed ReDoS (by @ericcornelissen).

4.25.2

Fixed Node.js --permission support (by @broofa).

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.48.0

Added firefox >= esr query support (by @SethFalco).

Fixed docs (by @SethFalco).

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Fixed throwOnMissing with extends query (by @alexander-akait).

4.26.2

Fixed baseline-browser-mapping version requirement.

... (truncated)

Commits

f2f2e6c Release 4.28.8 version
d0787c8 Update dependencies
fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
57ecd64 fix: support "including kaios" without downstream
093a0f6 Update EM banner
b637868 Release 4.28.7 version
313f465 Update dependencies
c935c5a Fix regexp performance
d7e9e65 Rewrite structure parsing to make it always fast
ec4a55e Fix import order
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates nanoid from 3.3.11 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Changelog

Sourced from nanoid's changelog.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Commits

9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
ba0bc3b Do not create latest release for v3
6819724 Release 3.3.15 version
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates postcss-selector-parser from 7.1.0 to 7.1.5

Release notes

Sourced from postcss-selector-parser's releases.

7.1.5

fix: don't treat a non-prefix token before | as a namespace (#324 by @spokodev)

fix: preserve whitespace before a * namespace in attribute selectors (#325 by @spokodev)

fix: TypeError on unclosed [, ( and trailing | (#330 by @theRizwan)

7.1.4

fix: tolerate non-node children when serializing selectors

7.1.3

Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @MoOx)

v7.1.1

7.1.1

perf: replace startsWith with strict equality (#308)

fix(types): add walkUniversal declaration (#311)

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.5 - 2026-08-07

fix: don't treat a non-prefix token before | as a namespace (#324 by @spokodev)

fix: preserve whitespace before a * namespace in attribute selectors (#325 by @spokodev)

fix: TypeError on unclosed [, ( and trailing | (#330 by @theRizwan)

7.1.4 - 2026-06-11

fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @MoOx)

7.1.1

perf: replace startsWith with strict equality (#308)

fix(types): add walkUniversal declaration (#311)

Commits

e33e9bc 7.1.5
6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
4a7e4e3 7.1.4
e2021c5 fix: tolerate non-node children when serializing selectors
7893b74 7.1.3
5bc698c Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clo...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 3 updates in the /core directory: [browserslist](https://github.com/browserslist/browserslist), [nanoid](https://github.com/ai/nanoid) and [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser). Updates `browserslist` from 4.24.5 to 4.28.8 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.28.8) Updates `nanoid` from 3.3.11 to 3.3.18 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.18) Updates `postcss-selector-parser` from 7.1.0 to 7.1.5 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v7.1.0...7.1.5) --- updated-dependencies: - dependency-name: browserslist dependency-version: 4.28.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss-selector-parser dependency-version: 7.1.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 2, 2026

Navigation Menu

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates - #65

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates#65
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/core/npm_and_yarn-b38de87934

dependabot Bot commented on behalf of github Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.28.2

4.28.1

4.27.0

4.26.3

4.26.2

4.26.1

4.26.0

4.25.4

4.25.3

4.25.2

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.28.2

4.28.1

4.48.0

4.27.0

4.26.3

4.26.2

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

7.1.5

7.1.4

7.1.3

7.1.2

v7.1.1

7.1.1

7.1.5 - 2026-08-07

7.1.4 - 2026-06-11

7.1.3 - 2026-06-11

7.1.2 - 2026-06-09

7.1.1

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants