build(deps): Bump picomatch, @nextcloud/eslint-config and sass by dependabot[bot] · Pull Request #895 · nextcloud-libraries/nextcloud-router

dependabot · 2026-07-11T01:25:25Z

Bumps picomatch to 4.0.5 and updates ancestor dependencies picomatch, @nextcloud/eslint-config and sass. These dependencies need to be updated together.

Updates picomatch from 4.0.3 to 4.0.5

Release notes

Sourced from picomatch's releases.

4.0.5

What's Changed

fix: preserve all branches when rewriting risky repeated extglobs by @MerlijnW70 in micromatch/picomatch#182

fix: honor the windows option when matching basenames by @MerlijnW70 in micromatch/picomatch#183

New Contributors

@MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

4f41a8e 4.0.5
02cfc1b Update .verb.md and run verb to generate README documentation
cc52ff6 Only run the upload code coverage step for 1 matrix permutation
6d426d7 Allow workflow to continue if the code coverage step to fails
a00b954 Merge branch 'codeql-coverage'
9680381 Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename
648b4f2 Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches
70e6485 Configure code coverage upload for CodeQL
ab8bc4d fix: honor the windows option when matching basenames
6289307 fix: preserve all branches when rewriting risky repeated extglobs
Additional commits viewable in compare view

Updates picomatch from 4.0.2 to 4.0.5

Release notes

Sourced from picomatch's releases.

4.0.5

What's Changed

fix: preserve all branches when rewriting risky repeated extglobs by @MerlijnW70 in micromatch/picomatch#182

fix: honor the windows option when matching basenames by @MerlijnW70 in micromatch/picomatch#183

New Contributors

@MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

4f41a8e 4.0.5
02cfc1b Update .verb.md and run verb to generate README documentation
cc52ff6 Only run the upload code coverage step for 1 matrix permutation
6d426d7 Allow workflow to continue if the code coverage step to fails
a00b954 Merge branch 'codeql-coverage'
9680381 Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename
648b4f2 Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches
70e6485 Configure code coverage upload for CodeQL
ab8bc4d fix: honor the windows option when matching basenames
6289307 fix: preserve all branches when rewriting risky repeated extglobs
Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 4.0.5

Release notes

Sourced from picomatch's releases.

4.0.5

What's Changed

fix: preserve all branches when rewriting risky repeated extglobs by @MerlijnW70 in micromatch/picomatch#182

fix: honor the windows option when matching basenames by @MerlijnW70 in micromatch/picomatch#183

New Contributors

@MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

4f41a8e 4.0.5
02cfc1b Update .verb.md and run verb to generate README documentation
cc52ff6 Only run the upload code coverage step for 1 matrix permutation
6d426d7 Allow workflow to continue if the code coverage step to fails
a00b954 Merge branch 'codeql-coverage'
9680381 Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename
648b4f2 Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches
70e6485 Configure code coverage upload for CodeQL
ab8bc4d fix: honor the windows option when matching basenames
6289307 fix: preserve all branches when rewriting risky repeated extglobs
Additional commits viewable in compare view

Updates @nextcloud/eslint-config from 8.4.2 to 9.0.1

Release notes

Sourced from @nextcloud/eslint-config's releases.

v9.0.1

v9.0.1 (2026-07-07)

Fixed

fix(vue): error on vue/attributes-order and vue/order-in-components instead of warn #1445 (susnux)

fix: no-deprecated-library-* rules incorrectly behave for nextcloud/vue syntax #1452 (Antreesy)

fix(no-deprecated-library-props): support win32 filesystem and different @nextcloud/vue directory structures #1454 (ShGKme)

fix(no-deprecated-library-props): support camelCase attributes #1453 (Antreesy)

fix: increase min. Node version to 22.14 #1455 (susnux)

v9.0.0

v9.0.0 (2026-06-26)

Breaking

This package now is using ESLint v10 and requires ESLint flat configurations. Please refer to the README on how to adjust your configuration for flat config.

Potential pitfalls

Some of the used eslint plugins still keep a ESLint v8 compatibility, this can cause some issues if not all packages are updated to the ESLint v10 compatible version.

If you see a linter error like the one below make sure to update all nested dependencies, either using the sledge hammer method (remove the lock file and run npm i) or by running npm update.

TypeError: scopeManager.addGlobals is not a function

Added

feat: migrate to ESLint v10 #1323 (susnux)

feat: new modular config for (and with) ESLint v9 support #887

feat: merge plugin repository #899

feat: enforce non-breaking spaces before ellipsis for translations #948

feat: add special config for libraries #949

feat: add import and export rules #981

feat: introduce @nextcloud/vue eslint plugin #939

feat(codeStyle): enforce top-level-function #1033 (ShGKme)

feat(nextcloud-vue): add rule for deprecated NcButton props #1045 (susnux)

feat(vue): add vue/no-useless-v-bind rule #1063 (susnux)

feat(vue): add vue/prefer-separate-static-class rule #1065 (susnux)

feat(vue3): add script-setup releated rules #1064 (susnux)

feat(no-deprecated-props): extend existing rules to support other components #1069 (Antreesy)

feat(imports): add custom plugin to suggest file extensions #1110 (susnux)

feat(filesystem): ignore all files within the .gitignore #1108 (susnux)

feat(l10n-plugin): also handle vue templates #1113 (susnux)

feat(nextcloud-vue-plugin): deprecate additional props #1163 (Antreesy)

feat(nextcloud-vue-plugin): deprecate additional exports #1162 (Antreesy)

feat(nextcloud-vue-plugin): deprecate NcPopover props #1165 (Antreesy)

feat(vue): add vue/component-options-name-casing with PascalCase #1261 (ShGKme)

feat(vue3): force camelCase for events in <script> #1262 (ShGKme)

feat(vue3): force camelCase for events in \<template> #1263 (ShGKme)

feat(vue3): force camelCase for slot names #1264 (ShGKme)

feat(vue3): force camelCase for props in template #1266 (ShGKme)

... (truncated)

Changelog

Sourced from @nextcloud/eslint-config's changelog.

v9.0.1 (2026-07-07)

Fixed

fix(vue): error on vue/attributes-order and vue/order-in-components instead of warn #1445 (susnux)

fix: no-deprecated-library-* rules incorrectly behave for nextcloud/vue syntax #1452 (Antreesy)

fix(no-deprecated-library-props): support win32 filesystem and different @nextcloud/vue directory structures #1454 (ShGKme)

fix(no-deprecated-library-props): support camelCase attributes #1453 (Antreesy)

fix: increase min. Node version to 22.14 #1455 (susnux)

v9.0.0 (2026-06-26)

Breaking

This package now is using ESLint v10 and requires ESLint flat configurations. Please refer to the README on how to adjust your configuration for flat config.

Potential pitfalls

Some of the used eslint plugins still keep a ESLint v8 compatibility, this can cause some issues if not all packages are updated to the ESLint v10 compatible version.

If you see a linter error like the one below make sure to update all nested dependencies, either using the sledge hammer method (remove the lock file and run npm i) or by running npm update.

TypeError: scopeManager.addGlobals is not a function

Added

feat: migrate to ESLint v10 #1323 (susnux)

feat: new modular config for (and with) ESLint v9 support #887

feat: merge plugin repository #899

feat: enforce non-breaking spaces before ellipsis for translations #948

feat: add special config for libraries #949

feat: add import and export rules #981

feat: introduce @nextcloud/vue eslint plugin #939

feat(codeStyle): enforce top-level-function #1033 (ShGKme)

feat(nextcloud-vue): add rule for deprecated NcButton props #1045 (susnux)

feat(vue): add vue/no-useless-v-bind rule #1063 (susnux)

feat(vue): add vue/prefer-separate-static-class rule #1065 (susnux)

feat(vue3): add script-setup releated rules #1064 (susnux)

feat(no-deprecated-props): extend existing rules to support other components #1069 (Antreesy)

feat(imports): add custom plugin to suggest file extensions #1110 (susnux)

feat(filesystem): ignore all files within the .gitignore #1108 (susnux)

feat(l10n-plugin): also handle vue templates #1113 (susnux)

feat(nextcloud-vue-plugin): deprecate additional props #1163 (Antreesy)

feat(nextcloud-vue-plugin): deprecate additional exports #1162 (Antreesy)

feat(nextcloud-vue-plugin): deprecate NcPopover props #1165 (Antreesy)

feat(vue): add vue/component-options-name-casing with PascalCase #1261 (ShGKme)

feat(vue3): force camelCase for events in <script> #1262 (ShGKme)

feat(vue3): force camelCase for events in \<template> #1263 (ShGKme)

feat(vue3): force camelCase for slot names #1264 (ShGKme)

feat(vue3): force camelCase for props in template #1266 (ShGKme)

feat(import): enforce consistent types imports and ban usage of inline type specifiers #1382 (susnux)

Fixed

... (truncated)

Commits

660197b Merge pull request #1456 from nextcloud-libraries/chore/v901
f466ba3 chore: prepare v9.0.1
3755602 Merge pull request #1455 from nextcloud-libraries/fix/reg-node
c3e12f3 Merge pull request #1453 from nextcloud-libraries/fix/1001/adjust-rules-camel...
282d890 fix: support camelCase attributes for deprecations
6e88372 fix: increase min. Node version to 22.14
4f469a3 Merge pull request #1454 from nextcloud-libraries/fix/find-package-json-lib
1662e34 fix(no-deprecated-library-props): support win32 fs
0e56404 Merge pull request #1447 from nextcloud-libraries/dependabot/npm_and_yarn/esl...
60bb082 Merge pull request #1452 from nextcloud-libraries/fix/1001/adjust-rules
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @nextcloud/eslint-config since your current version.

Updates sass from 1.70.0 to 1.101.0

Release notes

Sourced from sass's releases.

Dart Sass 1.101.0

To install Sass 1.101.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Potentially breaking bug fix: The Node package importer now properly supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these files were ignored even when loaded via @import, so any code relying on loading module-system-only files this way may break.

See the full changelog for changes in earlier releases.

Dart Sass 1.100.0

To install Sass 1.100.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

See the Sass website for details.

See the full changelog for changes in earlier releases.

Dart Sass 1.99.0

To install Sass 1.99.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Add support for parent selectors (&) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as the scoping root.

User-defined functions named calc or clamp are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in calc() or clamp() function.

User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers.

User-defined functions named EXPRESSION, URL, and ELEMENT, those that begin with - and end with -ELEMENT, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax.

See the Sass website for details.

In a future release, calls to functions whose names begin with - and end with -expression and -url will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future.

See the Sass website for details.

... (truncated)

Changelog

Sourced from sass's changelog.

1.101.0

Potentially breaking bug fix: The Node package importer now properly supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these files were ignored even when loaded via @import, so any code relying on loading module-system-only files this way may break.

1.100.0

Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

See the Sass website for details.

1.99.0

Add support for parent selectors (&) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as the scoping root.

User-defined functions named calc or clamp are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in calc() or clamp() function.

User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers.

User-defined functions named EXPRESSION, URL, and ELEMENT, those that begin with - and end with -ELEMENT, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax.

See the Sass website for details.

In a future release, calls to functions whose names begin with - and end with -expression and -url will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future.

See the Sass website for details.

Calls to functions whose names begin with - and end with -progid:... are deprecated.

... (truncated)

Commits

63b9922 Load import-only files through package.json exports (#2772)
c7e9947 Migrate from bufbuild/buf-setup-action to bufbuild/buf-action (#2773)
7674a4c Bump postcss from 8.5.13 to 8.5.15 in /pkg/sass-parser (#2774)
5fd18c7 Bump node engine requirement to >=20.19.0 and chokidar requirement to ^5.0.0 ...
8c1d984 Deprecate adjacent compound selectors (#2765)
8e5f718 Bump postcss from 8.5.12 to 8.5.13 in /pkg/sass-parser (#2767)
1447f9b Bump postcss from 8.5.8 to 8.5.12 in /pkg/sass-parser (#2766)
83c39fe Support the top-level parent selector (#2758)
ec85871 Bump EndBug/add-and-commit from 9 to 10 (#2756)
a604acd [Function Name] Implement changes (#2731)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sass since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [picomatch](https://github.com/micromatch/picomatch) to 4.0.5 and updates ancestor dependencies [picomatch](https://github.com/micromatch/picomatch), [@nextcloud/eslint-config](https://github.com/nextcloud-libraries/eslint-config) and [sass](https://github.com/sass/dart-sass). These dependencies need to be updated together. Updates `picomatch` from 4.0.3 to 4.0.5 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.5) Updates `picomatch` from 4.0.2 to 4.0.5 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.5) Updates `picomatch` from 2.3.1 to 4.0.5 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.5) Updates `@nextcloud/eslint-config` from 8.4.2 to 9.0.1 - [Release notes](https://github.com/nextcloud-libraries/eslint-config/releases) - [Changelog](https://github.com/nextcloud-libraries/eslint-config/blob/main/CHANGELOG.md) - [Commits](nextcloud-libraries/eslint-config@v8.4.2...v9.0.1) Updates `sass` from 1.70.0 to 1.101.0 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.70.0...1.101.0) --- updated-dependencies: - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect - dependency-name: "@nextcloud/eslint-config" dependency-version: 9.0.1 dependency-type: direct:development - dependency-name: sass dependency-version: 1.101.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-11T01:25:25Z

Labels

The following labels could not be found: type: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions Bot approved these changes Jul 11, 2026

View reviewed changes

github-actions Bot enabled auto-merge July 11, 2026 01:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): Bump picomatch, @nextcloud/eslint-config and sass#895

build(deps): Bump picomatch, @nextcloud/eslint-config and sass#895
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-01ef78f2fe

dependabot Bot commented on behalf of github Jul 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 11, 2026

4.0.5

What's Changed

New Contributors

4.0.4

What's Changed

4.0.5

What's Changed

New Contributors

4.0.4

What's Changed

4.0.5

What's Changed

New Contributors

4.0.4

What's Changed

v9.0.1

v9.0.1 (2026-07-07)

Fixed

v9.0.0

v9.0.0 (2026-06-26)

Breaking

Potential pitfalls

Added

v9.0.1 (2026-07-07)

Fixed

v9.0.0 (2026-06-26)

Breaking

Potential pitfalls

Added

Fixed

Dart Sass 1.101.0

Changes

Dart Sass 1.100.0

Changes

Dart Sass 1.99.0

Changes

1.101.0

1.100.0

1.99.0

Uh oh!

dependabot Bot commented on behalf of github Jul 11, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants