Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 4, 2025

Bumps jekyll-minifier from 0.1.10 to 0.2.2.

Changelog

Sourced from jekyll-minifier's changelog.

[0.2.2] - 2024-09-04

Fixed

  • Removed problematic content validation checks that could incorrectly reject valid files (#64)
    • CSS, JavaScript, JSON, and HTML content validation is now delegated to the actual minification libraries
    • These libraries have proper parsers and handle edge cases correctly
  • Fixed environment validation test that was failing due to missing environment mocking
  • All 166 tests now passing (100% pass rate)

Security

  • Maintained all critical security validations:
    • File size limits (50MB max)
    • File encoding validation
    • File path traversal protection
    • ReDoS pattern detection with timeout guards

Changed

  • Content validation is now handled by the minification libraries themselves (Terser, CSSminify2, JSON.minify, HtmlCompressor)
  • Improved test environment mocking for consistent test results

Maintenance

  • Cleaned up repository by removing tracked database files and test artifacts
  • Updated .gitignore to exclude temporary files, databases, and OS-specific files
  • Improved build process reliability

[0.2.1] - Previous Release

Security

  • Added comprehensive ReDoS protection with pattern validation and timeout guards
  • Implemented input validation system for configuration values
  • Added file path security checks to prevent directory traversal

Features

  • Enhanced CSS compression with cssminify2 v2.1.0 features
  • Compressor object caching for improved performance
  • Comprehensive configuration validation

Performance

  • Implemented caching system for compressor instances
  • Added cache statistics tracking
  • Optimized compression workflow

[0.2.0] - Earlier releases

Please see the GitHub releases page for earlier version history.

Commits
  • ae0c2f6 chore: remove test artifacts
  • c1139c1 chore: bump version to 0.2.2 for release
  • 23cd825 chore: remove test artifacts
  • 58fe14d test: fix environment validation test by adding proper mocking
  • d3ff06d chore: clean up repository and improve build process
  • 13ada05 clean: remove accidentally created test files
  • 13e8a9f fix: remove unnecessary content validation checks
  • c7e1fef clean: remove accidentally committed test files
  • 26b9c0e feat: implement compressor object caching for performance optimization
  • 47ff89e feat: add comprehensive input validation system
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [jekyll-minifier](https://github.com/digitalsparky/jekyll-minifier) from 0.1.10 to 0.2.2.
- [Release notes](https://github.com/digitalsparky/jekyll-minifier/releases)
- [Changelog](https://github.com/digitalsparky/jekyll-minifier/blob/master/CHANGELOG.md)
- [Commits](digitalsparky/jekyll-minifier@0.1.10...v0.2.2)

---
updated-dependencies:
- dependency-name: jekyll-minifier
  dependency-version: 0.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from akkinoc as a code owner September 4, 2025 14:32
@dependabot dependabot bot added this to the 2025 milestone Sep 4, 2025
@dependabot dependabot bot added the type:dependencies A dependency update. label Sep 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type:dependencies A dependency update.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants