[dependabot]

Bumps the npm group with 3 updates: html-minifier-next, js-yaml and stylelint-order.

Updates html-minifier-next from 8.10.2 to 8.10.7

Changelog

Sourced from html-minifier-next's changelog.

[8.10.7] - 2026-10-07

Fixed

• Fixed the ignoreCustomFragments ReDoS check leaving subtraction and intersection in v-flag character classes unjudged (e.g., [[ab]&&[bc]]*b*) and reading a subtracted character as a range (e.g., [a--b]*b*), which flagged patterns that do not backtrack and missed ones that do

[8.10.6] - 2026-10-06

Fixed

• Fixed minifyJS, minifyCSS, and processScripts reading SVG script and style content as written outside minifySVG, which left it unminified where it held character references (e.g., <svg><script>if (a &amp;&amp; b) c()</script></svg>)
• Fixed script and style elements in SVG and MathML being read as raw text where HTML reads markup, which broke the output where a CDATA section held their end tag (e.g., <svg><script><![CDATA[x("</script>")]]></script></svg>), kept character references under decodeEntities, and minified MathML script and style content, which neither runs nor applies
• Fixed CDATA sections in SVG and MathML being read as comments, which removeComments removed with their text, collapseWhitespace removed whitespace next to, and the first ]> ended; an unclosed one no longer fails the parse
• Fixed mergeScripts merging MathML script elements, whose text is shown
• Fixed removeUnusedCSS missing class names and IDs written with character references in SVG scripts
• Fixed HTML elements that end SVG and MathML content (e.g., <svg><p> or <math><div>) being read as foreign, which kept script and style elements after them from holding raw text: An unescaped < failed the parse, and decodeEntities and minifyCSS decoded character references (e.g., <svg><b><script>if (a &amp;&amp; b) c()</script></b></svg>)

Changed

• An unescaped < that starts no tag in an SVG script or style element is now a parse error, as it is in HTML content; write it as < or within a CDATA section, or use continueOnParseError
• Improved performance, with less work for attributes without a default value, for trailing whitespace next to start tags and text, and for start tags without maxLineLength

[8.10.5] - 2026-10-05

Fixed

• Fixed minifySVG leaving SVG unoptimized when it contains a bare & (e.g., <text>A & B</text>) or a character reference only HTML reads (e.g., &copy or ≂̸)
• Fixed minifySVG turning references HTML reads as Windows-1252 characters into control characters (e.g., &[#128](https://github.com/j9t/html-minifier-next/issues/128); into U+0080 rather than €)
• Fixed minifyCSS and minifyJS reading character references and CDATA sections in SVG as written under minifySVG, which removed style attributes and rules (e.g., style="font-family: "Fira Sans"") and left scripts unminified

[8.10.4] - 2026-10-04

Changed

• Improved decodeEntities performance, with text and attribute values that contain entities decoded synchronously once the entity decoder has loaded
• Improved CLI performance on worker threads, with the largest files handed out first so that a large file found late no longer holds up the run

[8.10.3] - 2026-10-03

Fixed

• Fixed unquoted attribute values of about 20 KB or more being cut short, with the rest written out as an attribute of its own (e.g., a long data: URL in <img src=…>)

Changed

• Improved attribute performance, with less work for attributes that collapse to their name as well as for srcset values

Commits

• See full diff in compare view

Updates js-yaml from 5.4.2 to 5.4.3

Changelog

Sourced from js-yaml's changelog.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

Commits

• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• See full diff in compare view

Updates stylelint-order from 8.1.1 to 8.1.2

Release notes

Sourced from stylelint-order's releases.

8.1.2

• Fixed compatibility with the upcoming Stylelint v18

Changelog

Sourced from stylelint-order's changelog.

8.1.2

• Fixed compatibility with the upcoming Stylelint v18

Commits

• f7d9fa8 8.1.2
• 3ca8e28 Prepare 8.1.2
• 9a53b17 Update dependencies
• 2b4f934 Fix tests with Stylelint v18 branch (#221)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions