You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Standardized on anymatch library for globbing paths. All globs should work the same between src and watch now!
Removed support for ordered globs. This aligns with the chokidar globbing implementation. If you need your globs to be ordered, you can use ordered-read-stream
All globs and paths are normalized to unix-like filepaths
Only allow JS variants for .gulp.* config files
Removed support for alpha releases of v4 from gulp-cli
Removed the --verify flag
Renamed the --require flag to --preload to avoid conflicting with Node.js flags
Removed many legacy and deprecated loaders
Upgrade to chokidar v3
Clone Vinyl objects with stream contents using teex, but no longer wait for all streams to flow before cloned streams will receive data
Stop using process.umask() to make directories, instead falling back to Node's default mode
Throw on non-function, non-string option coercers
Drop support of Node.js snake_case flags
Use a Symbol for attaching the gulplog namespace to the store
Use a Symbol for attaching the gulplog store to the global
Use sha256 to hash the v8flags cache into a filename
Features
Streamlined the dependency tree
Switch all streams implementation to Streamx
Rewrote glob-stream to use a custom directory walk that relies on newer Node.js features and is more performant than old implementation
Implement translation support for all CLI messages and all messages passing through gulplog
Allow users to customize or remove the timestamp from their logs
Upgraded gulplog to v2. Messages logged via v1 will also display a deprecated warning. Plugins should update to v2 as the community upgrades to gulp 5
Added support for gulpile.cjs and gulpfile.mjs
Add support for swc, esbuild, sucrase, and mdx loaders
replaced 3.x task system (orchestrator) with new task system (bach)
removed gulp.reset
removed 3 argument syntax for gulp.task
gulp.task should only be used when you will call the task with the CLI
added gulp.series and gulp.parallel methods for composing tasks. Everything must use these now.
added single argument syntax for gulp.task which allows a named function to be used as the name of the task and task function.
added gulp.tree method for retrieving the task tree. Pass { deep: true } for an archy compatible node list.
added gulp.registry for setting custom registries.
CLI changes
split CLI out into a module if you want to save bandwidth/disk space. you can install the gulp CLI using either npm install gulp -g or npm install gulp-cli -g, where gulp-cli is the smaller one (no module code included)
add --tasks-json flag to CLI to dump the whole tree out for other tools to consume
added --verify flag to check the dependencies in package.json against the plugin blacklist.
vinyl/vinyl-fs changes
added gulp.symlink which functions exactly like gulp.dest, but symlinks instead.
added dirMode param to gulp.dest and gulp.symlink which allows better control over the mode of the destination folder that is created.
globs passed to gulp.src will be evaluated in order, which means this is possible gulp.src(['*.js', '!b*.js', 'bad.js']) (exclude every JS file that starts with a b except bad.js)
performance for gulp.src has improved massively
gulp.src(['**/*', '!b.js']) will no longer eat CPU since negations happen during walking now
added since option to gulp.src which lets you only match files that have been modified since a certain date (for incremental builds)
fixed gulp.src not following symlinks
added overwrite option to gulp.dest which allows you to enable or disable overwriting of existing files
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
If you want to rebase/retry this PR, check this box
Next steps: Take a moment to review the security alert
above. Review the linked package source code to understand the potential
risk. Ensure the package is not malicious before proceeding. If you're
unsure how to proceed, reach out to your security team or ask the Socket
team for help at support@socket.dev.
Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/merge-deep@1.0.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Next steps: Take a moment to review the security alert
above. Review the linked package source code to understand the potential
risk. Ensure the package is not malicious before proceeding. If you're
unsure how to proceed, reach out to your security team or ask the Socket
team for help at support@socket.dev.
Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/set-value@0.2.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
renovate
bot
force-pushed
the
renovate/gulp-5.x
branch
from
This PR contains the following updates:
3.9.1→5.0.1Release Notes
gulpjs/gulp (gulp)
v5.0.1Compare Source
v5.0.0Compare Source
We've tried to provide a high-level changelog for gulp v5 below, but it
doesn't contain all changes from the 60+ dependencies that we maintain.
Please see individual changelogs to drill down
into all changes that were made.
⚠ BREAKING CHANGES
anymatchlibrary for globbing paths. All globs should work the same betweensrcandwatchnow!ordered-read-stream.gulp.*config filesgulp-cli--verifyflag--requireflag to--preloadto avoid conflicting with Node.js flagsVinylobjects with stream contents usingteex, but no longer wait for all streams to flow before cloned streams will receive dataprocess.umask()to make directories, instead falling back to Node's default modegulplognamespace to the storegulplogstore to the globalv8flagscache into a filenameFeatures
glob-streamto use a custom directory walk that relies on newer Node.js features and is more performant than old implementationgulpile.cjsandgulpfile.mjsswc,esbuild,sucrase, andmdxloadersVinylcontentsextendssyntax for.gulp.*config filegulpfileandpreloadsvia.gulp.*config fileBug Fixes
to-absolute-globto:../at the beginning of globsMiscellaneous Chores
stream,readable-stream, andstreamxIndividual Changelogs
We created and maintain various projects that gulp depends upon. You can find their changelogs linked below:
v4.0.2Compare Source
Fix
Docs
Build
v4.0.1Compare Source
Fix
Docs
(c960c1d)
Upgrade
Build
Scaffold
v4.0.0Compare Source
Task system changes
gulp.taskgulp.taskshould only be used when you will call the task with the CLIgulp.seriesandgulp.parallelmethods for composing tasks. Everything must use these now.gulp.taskwhich allows a named function to be used as the name of the task and task function.gulp.treemethod for retrieving the task tree. Pass{ deep: true }for anarchycompatible node list.gulp.registryfor setting custom registries.CLI changes
npm install gulp -gornpm install gulp-cli -g, where gulp-cli is the smaller one (no module code included)--tasks-jsonflag to CLI to dump the whole tree out for other tools to consume--verifyflag to check the dependencies in package.json against the plugin blacklist.vinyl/vinyl-fs changes
gulp.symlinkwhich functions exactly likegulp.dest, but symlinks instead.dirModeparam togulp.destandgulp.symlinkwhich allows better control over the mode of the destination folder that is created.gulp.srcwill be evaluated in order, which means this is possiblegulp.src(['*.js', '!b*.js', 'bad.js'])(exclude every JS file that starts with a b except bad.js)gulp.src(['**/*', '!b.js'])will no longer eat CPU since negations happen during walking nowsinceoption togulp.srcwhich lets you only match files that have been modified since a certain date (for incremental builds)gulp.srcnot following symlinksoverwriteoption togulp.destwhich allows you to enable or disable overwriting of existing filesConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.