build(deps): bump lodash.template, gulp, gulp-autoprefixer, gulp-clean-css, gulp-rollup, gulp-sass and gulp-typedoc

[dependabot]

Bumps lodash.template to 4.18.1 and updates ancestor dependencies lodash.template, gulp, gulp-autoprefixer, gulp-clean-css, gulp-rollup, gulp-sass and gulp-typedoc. These dependencies need to be updated together.

Updates lodash.template from 4.4.0 to 4.18.1

Release notes

Sourced from lodash.template's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates gulp from 3.9.1 to 5.0.1

Release notes

Sourced from gulp's releases.

gulp v5.0.1

Bug Fixes

• Avoid globbing before read stream is opened (#2839) (19122f3)
• Avoid Node.js deprecation warning for fs.Stats (#2838) (69a5d0e)
• Support top-level await on Node 22.12+ (#2836) (04b4a74)

gulp v5.0.0

We've tried to provide a high-level changelog for gulp v5 below, but it doesn't contain all changes from the 60+ dependencies that we maintain.

Please see individual changelogs to drill down into all changes that were made.

⚠ BREAKING CHANGES

• Drop support for Node.js <10.13
• Default stream encoding to UTF-8
• Standardized on anymatch library for globbing paths. All globs should work the same between src and watch now!
• Removed support for ordered globs. This aligns with the chokidar globbing implementation. If you need your globs to be ordered, you can use ordered-read-stream
• All globs and paths are normalized to unix-like filepaths
• Only allow JS variants for .gulp.* config files
• Removed support for alpha releases of v4 from gulp-cli
• Removed the --verify flag
• Renamed the --require flag to --preload to avoid conflicting with Node.js flags
• Removed many legacy and deprecated loaders
• Upgrade to chokidar v3
• Clone Vinyl objects with stream contents using teex, but no longer wait for all streams to flow before cloned streams will receive data
• Stop using process.umask() to make directories, instead falling back to Node's default mode
• Throw on non-function, non-string option coercers
• Drop support of Node.js snake_case flags
• Use a Symbol for attaching the gulplog namespace to the store
• Use a Symbol for attaching the gulplog store to the global
• Use sha256 to hash the v8flags cache into a filename

Features

• Streamlined the dependency tree
• Switch all streams implementation to Streamx
• Rewrote glob-stream to use a custom directory walk that relies on newer Node.js features and is more performant than old implementation
• Implement translation support for all CLI messages and all messages passing through gulplog
• Allow users to customize or remove the timestamp from their logs
• Upgraded gulplog to v2. Messages logged via v1 will also display a deprecated warning. Plugins should update to v2 as the community upgrades to gulp 5
• Added support for gulpile.cjs and gulpfile.mjs
• Add support for swc, esbuild, sucrase, and mdx loaders
• Provide an ESM export (#2760) (b00de68)
• Support sourcemap handling on streaming Vinyl contents

... (truncated)

Changelog

Sourced from gulp's changelog.

5.0.1 (2025-06-01)

Bug Fixes

• Avoid globbing before read stream is opened (#2839) (19122f3)
• Avoid Node.js deprecation warning for fs.Stats (#2838) (69a5d0e)
• Support top-level await on Node 22.12+ (#2836) (04b4a74)

5.0.0 (2024-03-29)

We've tried to provide a high-level changelog for gulp v5 below, but it doesn't contain all changes from the 60+ dependencies that we maintain.

Please see individual changelogs to drill down into all changes that were made.

⚠ BREAKING CHANGES

• Drop support for Node.js <10.13
• Default stream encoding to UTF-8
• Standardized on anymatch library for globbing paths. All globs should work the same between src and watch now!
• Removed support for ordered globs. This aligns with the chokidar globbing implementation. If you need your globs to be ordered, you can use ordered-read-stream
• All globs and paths are normalized to unix-like filepaths
• Only allow JS variants for .gulp.* config files
• Removed support for alpha releases of v4 from gulp-cli
• Removed the --verify flag
• Renamed the --require flag to --preload to avoid conflicting with Node.js flags
• Removed many legacy and deprecated loaders
• Upgrade to chokidar v3
• Clone Vinyl objects with stream contents using teex, but no longer wait for all streams to flow before cloned streams will receive data
• Stop using process.umask() to make directories, instead falling back to Node's default mode
• Throw on non-function, non-string option coercers
• Drop support of Node.js snake_case flags
• Use a Symbol for attaching the gulplog namespace to the store
• Use a Symbol for attaching the gulplog store to the global
• Use sha256 to hash the v8flags cache into a filename

Features

• Streamlined the dependency tree
• Switch all streams implementation to Streamx
• Rewrote glob-stream to use a custom directory walk that relies on newer Node.js features and is more performant than old implementation
• Implement translation support for all CLI messages and all messages passing through gulplog
• Allow users to customize or remove the timestamp from their logs
• Upgraded gulplog to v2. Messages logged via v1 will also display a deprecated warning. Plugins should update to v2 as the community upgrades to gulp 5
• Added support for gulpile.cjs and gulpfile.mjs
• Add support for swc, esbuild, sucrase, and mdx loaders
• Provide an ESM export (#2760) (b00de68)
• Support sourcemap handling on streaming Vinyl contents

... (truncated)

Commits

• 0003e9f chore: release 5.0.1 (#2837)
• 19122f3 fix: Avoid globbing before read stream is opened (#2839)
• 69a5d0e fix: Avoid Node.js deprecation warning for fs.Stats (#2838)
• 04b4a74 fix: Support top-level await on Node 22.12+ (#2836)
• c90e79e chore: Fix CI (#2835)
• 5412605 chore(docs): Update async completion document for newer RxJS (#2831)
• 2fa4981 chore: Update glob docs with replacement to ordered globs (#2788)
• fe9dee6 chore: Remove locale docs (#2787)
• a85eddb chore: Remove node-glob options from docs (#2786)
• 9c818e6 chore: update src.md docs to add encoding parameter
• Additional commits viewable in compare view

Updates gulp-autoprefixer from 3.1.1 to 10.0.0

Release notes

Sourced from gulp-autoprefixer's releases.

v10.0.0

Breaking

• Require Node.js 20 de36be2

Fixes

• Fix sourcemap preservation for multiple source files e4a6bbb

---

sindresorhus/gulp-autoprefixer@v9.0.0...v10.0.0

v9.0.0

Breaking

• Require Node.js 18 66cef58
• This package is now pure ESM. Please read this.

sindresorhus/gulp-autoprefixer@v8.0.0...v9.0.0

v8.0.0

Breaking

• Require Node.js 12 a953087

Improvements

• Upgrade dependencies a953087

sindresorhus/gulp-autoprefixer@v7.0.1...v8.0.0

v7.0.1

• Make Gulp an optional peer dependency da50fd2

sindresorhus/gulp-autoprefixer@v7.0.0...v7.0.1

v7.0.0

Breaking:

• Require Node.js 8 and Gulp 4 ab49120

sindresorhus/gulp-autoprefixer@v6.1.0...v7.0.0

v6.1.0

• Upgrade dependencies 7b080bf

sindresorhus/gulp-autoprefixer@v6.0.0...v6.1.0

Commits

• cb10f04 10.0.0
• de36be2 Require Node.js 20
• e4a6bbb Fix sourcemap preservation for multiple source files
• ef29ed0 Add tests for #72
• 4b215c5 9.0.0
• 66cef58 Require Node.js 18 and move to ESM
• 682984e Meta tweaks
• ede5a11 8.0.0
• a953087 Require Node.js 12 and upgrade dependencies
• 87ff53d Move to GitHub Actions (#117)
• Additional commits viewable in compare view

Updates gulp-clean-css from 3.0.4 to 3.10.0

Release notes

Sourced from gulp-clean-css's releases.

3.10.0

• scniro/gulp-clean-css#63

3.9.4

• update deps (mitigate known vulnerabilities)

3.9.3

• #57

3.9.2

• scniro/gulp-clean-css#50 (see discussion)

3.9.1

• scniro/gulp-clean-css#50

update clean-css dep to 4.1.9

https://github.com/jakubpawlowicz/clean-css/releases/tag/v4.1.9

update clean-css dep to 4.1.8

https://github.com/jakubpawlowicz/clean-css/releases/tag/v4.1.8

update clean-css dep to 4.1.7

https://github.com/jakubpawlowicz/clean-css/releases/tag/v4.1.7

update clean-css dep to 4.1.6

https://github.com/jakubpawlowicz/clean-css/releases/tag/v4.1.6

update clean-css dep to 4.1.5

https://github.com/jakubpawlowicz/clean-css/releases/tag/v4.1.5

inlined imports should be rebased to current file

#44

Fix #43 - dep update

clean-css => 4.1.3

Fixes #42

rebase: false by default

scniro/gulp-clean-css#42

3.3.0

Fixing rebasing as seen at jakubpawlowicz/clean-css#937. Update clean-css to 4.1.2

3.2.0

Update clean css dep (4.1.1)

3.1.1

use strict for let support

... (truncated)

Commits

• See full diff in compare view

Updates gulp-rollup from 2.13.0 to 2.17.0

Commits

• b32b72b Bump 2.17.0
• cea9349 Update README.md (#81)
• 4283f8b Update README.md (#79)
• 4b455b4 Merge pull request #78 from kuraga/rollup-0.68
• f5b8483 Merge branch 'master' into rollup-0.68
• 06a26b7 Turn off Node 5 in Travis
• f96240b Update Rollup
• 9f273ec Merge pull request #73 from mcasimir/ver2-16-2
• 706a55a 2.16.2
• 1191482 Merge pull request #72 from petabyteboy/patch-1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by kuraga, a new releaser for gulp-rollup since your current version.

Updates gulp-sass from 3.1.0 to 6.0.1

Release notes

Sourced from gulp-sass's releases.

v6.0.1

Fixes

• Fix regressions in source maps (@​wkillerud, #875)

v6.0.0

First and foremost a huge shout out to @​wkillerud for making this long awaited release possible <3

Breaking changes

• Migrate to use the new Sass JS API by default (@​wkillerud, #846)

Documentation

• Update the watch task documentation (@​g1eny0ung, #847) & (@​xzyfer)

Upgrading to v6

gulp-sass version 6 uses the new compile function internally by default. If you use any options, for instance custom importers, please compare the new options with the legacy options in order to migrate. For instance, the outputStyle option is now called style.

  function buildStyles() {
    return gulp.src('./sass/**/*.scss')
-     .pipe(sass({outputStyle: 'compressed'}).on('error', sass.logError))
+     .pipe(sass({style: 'compressed'}).on('error', sass.logError))
      .pipe(gulp.dest('./css'));
  };

If you want to keep using the legacy API while it's available, you can.

const sass = require('gulp-sass/legacy')(require('sass'));

or to continue using node-sass

npm install gulp-sass node-sass

const sass = require('gulp-sass/legacy')(require('node-sass'));

If you use source maps, you may see the result change somewhat. The result will typically be absolute file: URLs, rather than relative ones. The result may also be the source itself, URL encoded. You can optionally add custom importers to adjust the source maps according to your own needs.

New Contributors

• @​wkillerud made their first contribution in dlmanning/gulp-sass#846
• @​g1eny0ung made their first contribution in dlmanning/gulp-sass#847

Full Changelog: dlmanning/gulp-sass@v5.1.0...v6.0.0

... (truncated)

Changelog

Sourced from gulp-sass's changelog.

v6.0.1

March 5, 2025

https://github.com/dlmanning/gulp-sass/releases/tag/v6.0.1

v6.0.0

November 27, 2024

https://github.com/dlmanning/gulp-sass/releases/tag/v6.0.0

v5.0.0

June 25, 2021

https://github.com/dlmanning/gulp-sass/releases/tag/v5.0.0

v4.1.1

June 24, 2021

https://github.com/dlmanning/gulp-sass/releases/tag/v4.1.1

v4.1.0

April 23, 2020

https://github.com/dlmanning/gulp-sass/releases/tag/v4.1.0

v4.0.2

October 16, 2018

https://github.com/dlmanning/gulp-sass/releases/tag/v4.0.2

v4.0.1

Apr 8, 2018

https://github.com/dlmanning/gulp-sass/releases/tag/v4.0.1

v4.0.0

April 5, 2018

https://github.com/dlmanning/gulp-sass/releases/tag/v4.0.0

v3.2.1

... (truncated)

Commits

• 333c4ce 6.0.1
• 9ce7c0c Fix regressions in source maps (#876)
• 8a45970 6.0.0
• 76e27b8 Run lint action on Node 16
• d373996 Update watch function docs
• 9b7578d docs: watch task should be a function (#847)
• 510c1c8 Migrate to use the new Sass JS API by default (#846)
• c04bb67 5.1.0
• 835d6f3 Add sass tests too (#842)
• 4e8c5de Update CHANGELOG.md (#831)
• Additional commits viewable in compare view

Updates gulp-typedoc from 2.0.2 to 2.2.9

Release notes

Sourced from gulp-typedoc's releases.

fix security issue

No release notes provided.

fix security issue

No release notes provided.

remove unused files from published package

No release notes provided.

Security update

No release notes provided.

security update

No release notes provided.

support typedoc 0.16.1+

No release notes provided.

update vulnerable dependencies

No release notes provided.

fix dependency on event-stream

No release notes provided.

Add TypeScript typings

• Fixed security issue in dependency
• Add TypeScript type definitions

Remove deprecated dependency gulp-util

No release notes provided.

bugfix in package.json

No release notes provided.

Add support for 'logger' option.

No release notes provided.

Don't error when there are no input files.

No release notes provided.

Commits

• 116693a v2.2.9
• db61a18 Merge pull request #32 from rogierschouten/dependabot/npm_and_yarn/highlight....
• c7b9181 v2.2.8
• 11cf974 Merge pull request #33 from rogierschouten/dependabot/npm_and_yarn/ini-1.3.7
• 1856768 Bump ini from 1.3.5 to 1.3.7
• 3207d12 Bump highlight.js from 10.4.0 to 10.4.1
• e6b67b5 v2.2.7: fix filename
• ca79138 v2.2.7: remove files from published version
• 91b9de4 v2.2.6
• 3bdc7f9 upgrade dependencies
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.