Skip to content

chore(deps): update dependency gulp to v5 #56

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update dependency gulp to v5 #56

wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 29, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
gulp (source) 3.9.1 -> 5.0.1 age adoption passing confidence

Release Notes

gulpjs/gulp (gulp)

v5.0.1

Compare Source

v5.0.0

Compare Source

We've tried to provide a high-level changelog for gulp v5 below, but it
doesn't contain all changes from the 60+ dependencies that we maintain.

Please see individual changelogs to drill down
into all changes that were made.

⚠ BREAKING CHANGES
  • Drop support for Node.js <10.13
  • Default stream encoding to UTF-8
  • Standardized on anymatch library for globbing paths. All globs should work the same between src and watch now!
  • Removed support for ordered globs. This aligns with the chokidar globbing implementation. If you need your globs to be ordered, you can use ordered-read-stream
  • All globs and paths are normalized to unix-like filepaths
  • Only allow JS variants for .gulp.* config files
  • Removed support for alpha releases of v4 from gulp-cli
  • Removed the --verify flag
  • Renamed the --require flag to --preload to avoid conflicting with Node.js flags
  • Removed many legacy and deprecated loaders
  • Upgrade to chokidar v3
  • Clone Vinyl objects with stream contents using teex, but no longer wait for all streams to flow before cloned streams will receive data
  • Stop using process.umask() to make directories, instead falling back to Node's default mode
  • Throw on non-function, non-string option coercers
  • Drop support of Node.js snake_case flags
  • Use a Symbol for attaching the gulplog namespace to the store
  • Use a Symbol for attaching the gulplog store to the global
  • Use sha256 to hash the v8flags cache into a filename
Features
  • Streamlined the dependency tree
  • Switch all streams implementation to Streamx
  • Rewrote glob-stream to use a custom directory walk that relies on newer Node.js features and is more performant than old implementation
  • Implement translation support for all CLI messages and all messages passing through gulplog
  • Allow users to customize or remove the timestamp from their logs
  • Upgraded gulplog to v2. Messages logged via v1 will also display a deprecated warning. Plugins should update to v2 as the community upgrades to gulp 5
  • Added support for gulpile.cjs and gulpfile.mjs
  • Add support for swc, esbuild, sucrase, and mdx loaders
  • Provide an ESM export (#​2760) (b00de68)
  • Support sourcemap handling on streaming Vinyl contents
  • Support extends syntax for .gulp.* config file
  • Allow overriding gulpfile and preloads via .gulp.* config file
Bug Fixes
  • Resolve bugs related to symlinks on various platforms
  • Resolved some reported ReDoS CVEs and improved performance in glob-parent
  • Rework errors surfaced when encountering files or symlinks when trying to create directories
  • Ensure watch allows japanese characters in globs (72668c6)
  • Ensure watch does not trigger on negated globs (72668c6)
  • Improve handling of BOM at the beginning of a stream
  • Properly handle function coercer in array of option coercers
  • Fork to-absolute-glob to:
    • Check negative patterns before trimming
    • Ensure glob-like characters are escaped in cwd & root options
    • Resolve ../ at the beginning of globs
Miscellaneous Chores
  • Remove lazystream dependency
  • Updated various stream test suites to test against Node.js core stream, readable-stream, and streamx
  • Normalize repository, dropping node <10.13 support (#​2758) (72668c6)
Individual Changelogs

We created and maintain various projects that gulp depends upon. You can find their changelogs linked below:

v4.0.2

Compare Source

Fix
Docs
Build
  • Add node 12 to Travis & Azure (b4b5a68)

v4.0.1

Compare Source

Fix
Docs
Upgrade
  • Update glob-watcher, gulp-cli, and undertaker dependencies & rimraf devDep (d3734d3)
Build
Scaffold
  • Mark *.png and *.jpg as binary files to git (a010db6)
  • Update some links and license year (1027236)
  • Add tidelift configuration (49b5aca)
  • Add new expense policy (9819957)
  • Add support-bot template (9078c49)

v4.0.0

Compare Source

Task system changes
  • replaced 3.x task system (orchestrator) with new task system (bach)
    • removed gulp.reset
    • removed 3 argument syntax for gulp.task
    • gulp.task should only be used when you will call the task with the CLI
    • added gulp.series and gulp.parallel methods for composing tasks. Everything must use these now.
    • added single argument syntax for gulp.task which allows a named function to be used as the name of the task and task function.
    • added gulp.tree method for retrieving the task tree. Pass { deep: true } for an archy compatible node list.
    • added gulp.registry for setting custom registries.
CLI changes
  • split CLI out into a module if you want to save bandwidth/disk space. you can install the gulp CLI using either npm install gulp -g or npm install gulp-cli -g, where gulp-cli is the smaller one (no module code included)
  • add --tasks-json flag to CLI to dump the whole tree out for other tools to consume
  • added --verify flag to check the dependencies in package.json against the plugin blacklist.
vinyl/vinyl-fs changes
  • added gulp.symlink which functions exactly like gulp.dest, but symlinks instead.
  • added dirMode param to gulp.dest and gulp.symlink which allows better control over the mode of the destination folder that is created.
  • globs passed to gulp.src will be evaluated in order, which means this is possible gulp.src(['*.js', '!b*.js', 'bad.js']) (exclude every JS file that starts with a b except bad.js)
  • performance for gulp.src has improved massively
    • gulp.src(['**/*', '!b.js']) will no longer eat CPU since negations happen during walking now
  • added since option to gulp.src which lets you only match files that have been modified since a certain date (for incremental builds)
  • fixed gulp.src not following symlinks
  • added overwrite option to gulp.dest which allows you to enable or disable overwriting of existing files

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security
Copy link

socket-security bot commented Mar 29, 2024 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgulp@​3.9.1 ⏵ 5.0.1100 +110010086100

View full report

@socket-security
Copy link

socket-security bot commented Mar 29, 2024 •
edited
Loading

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert (click for details)
Warn Critical
[email protected] has a Critical CVE.

CVE: GHSA-r6rj-9ch6-g264 Prototype pollution in Merge-deep (CRITICAL)

Affected versions: < 3.0.3

Patched version: 3.0.3

From: ? → npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
[email protected] has a Critical CVE.

CVE: GHSA-4g88-fppr-53pp Prototype Pollution in set-value (CRITICAL)

Affected versions: = 3.0.0; < 2.0.1; >= 3.0.0 < 3.0.1

Patched version: 2.0.1

From: ? → npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate bot force-pushed the renovate/gulp-5.x branch from e38952d to 5597231 Compare June 6, 2025 01:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants