v2 from 2.24.17 to 2.24.24 #385

New issue

Open

opened 2026-11-03 21:02:01 +00:00 by slurdge · 0 comments

slurdge commented

2026-11-03 21:02:01 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/slurdge/goeland/pull/392
Author: @dependabot[bot]
Created: 11/3/2026
Status: 🔄 Open

Base: master ← Head: dependabot/go_modules/github.com/tdewolff/minify/v2-2.24.24

📝 Commits (1)

4b83d61 chore(deps): bump github.com/tdewolff/minify/v2 from 2.24.17 to 2.24.24

📊 Changes

2 files changed (+9 additions, -9 deletions)

View changed files

📝 go.mod (+3 -3)
📝 go.sum (+6 -6)

📄 Description

Bumps github.com/tdewolff/minify/v2 from 2.24.17 to 2.24.24.

Release notes

Sourced from github.com/tdewolff/minify/v2's releases.

v2.24.24

HTML/JS: escape </script without immediately closing > in JS embedded in HTML

v2.24.23

HTML: support nested 's and 's, fixes tdewolff/minify#1055

Fix Python workflow, fixes tdewolff/minify#1056

v2.24.22

JS: fix timing bug or endless loop for some input, fixes #1049 and tdewolff/parse#132

v2.24.21

JS: fix infinite loop bug, fixes tdewolff/minify#1049

v2.24.20

JS: fix slow execution of many empty statements, found with OSSFuzz

JS: fix cases of slow parsing of JS, see tdewolff/parse#132

JS: fix appearance of script end tag or comment tag in regular expressions; don't stop minifying regexp when encountering slash in class

Update dependencies, require go1.26 due to golang.org/x/sys

v2.24.19

JS: security fix for escape or <!-- in HTML

v2.24.18

Update Minify.Bytes and Minify.String regarding buffer reuse

SVG: fix and improve pathdata minification, fixes tdewolff/minify#1023

Clone external command arguments before replacing file placeholders

Return output copy errors from external minifiers

SVG: undo removing first MoveTo command, it is mandatory

JS: fix precendence for &&= ||= ??= operators, fixes tdewolff/minify#1037

Fix security issue GHSA-3ppm-p7r9-c5w3; properly escape inside HTML script tag case-insensitively

Undo reuse of input byte slice in Minify.Bytes and Minify.String, it may cause problems if a minifier outputs longer output (rarely if never the case)

Commits

d78bc7d Fix Python workflow, fixes #1056
8bd401c HTML/JS: escape </script without immediately closing > in JS embedded in HTML
7599c9e Merge pull request #1054 from tdewolff/dependabot/github_actions/pypa/cibuild...
a89cc47 HTML: support nested <svg>'s and <math>'s, fixes #1055
50ea57c Fix Python workflow, fixes #1056
8c16699 Bump pypa/cibuildwheel from 4.2.1 to 4.3.1
cf8d180 Merge branch 'master' of github.com:tdewolff/minify
dfaa933 JS: fix timing bug or endless loop for some input
bcdb5dc Merge pull request #1050 from tdewolff/dependabot/npm_and_yarn/bindings/js/ty...
25b7bd8 Merge pull request #1051 from tdewolff/dependabot/npm_and_yarn/bindings/js/vi...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/slurdge/goeland/pull/392 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 11/3/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `dependabot/go_modules/github.com/tdewolff/minify/v2-2.24.24` --- ### 📝 Commits (1) - [`4b83d61`](https://github.com/slurdge/goeland/commit/4b83d61e4fac696e2ef20b46b54e3ac2bf0f9317) chore(deps): bump github.com/tdewolff/minify/v2 from 2.24.17 to 2.24.24 ### 📊 Changes **2 files changed** (+9 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `go.mod` (+3 -3) 📝 `go.sum` (+6 -6) </details> ### 📄 Description Bumps [github.com/tdewolff/minify/v2](https://github.com/tdewolff/minify) from 2.24.17 to 2.24.24. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tdewolff/minify/releases">github.com/tdewolff/minify/v2's releases</a>.</em></p> <blockquote> <h2>v2.24.24</h2> <ul> <li><a href="https://github.com/tdewolff/minify/commit/8bd401c7bfdb94d2c1b0b2f0e6705e4cb792b9a5">HTML/JS: escape </script without immediately closing > in JS embedded in HTML</a></li> </ul> <h2>v2.24.23</h2> <ul> <li><a href="https://github.com/tdewolff/minify/commit/a89cc4784cee48e7656a96fd9adfe9b45b5c8403">HTML: support nested 's and 's,</a> <a href="https://github.com/tdewolff/minify/commit/a89cc4784cee48e7656a96fd9adfe9b45b5c8403">fixes</a> <a href="https://redirect.github.com/tdewolff/minify/issues/1055">tdewolff/minify#1055</a></li> <li><a href="https://github.com/tdewolff/minify/commit/50ea57c43b57dfb58903c70249404ebf2940e4f5">Fix Python workflow,</a> <a href="https://github.com/tdewolff/minify/commit/50ea57c43b57dfb58903c70249404ebf2940e4f5">fixes</a> <a href="https://redirect.github.com/tdewolff/minify/issues/1056">tdewolff/minify#1056</a></li> </ul> <h2>v2.24.22</h2> <ul> <li>JS: fix timing bug or endless loop for some input, fixes <a href="https://redirect.github.com/tdewolff/minify/issues/1049">#1049</a> and <a href="https://redirect.github.com/tdewolff/parse/issues/132">tdewolff/parse#132</a></li> </ul> <h2>v2.24.21</h2> <ul> <li><a href="https://github.com/tdewolff/minify/commit/0fa517d42ad30404bd54ed5f71f8c97491657601">JS: fix infinite loop bug,</a> <a href="https://github.com/tdewolff/minify/commit/0fa517d42ad30404bd54ed5f71f8c97491657601">fixes</a> <a href="https://redirect.github.com/tdewolff/minify/issues/1049">tdewolff/minify#1049</a></li> </ul> <h2>v2.24.20</h2> <ul> <li><a href="https://github.com/tdewolff/minify/commit/8efb8aa3d1886a3ae20d68efc965ce7abab31b4a">JS: fix slow execution of many empty statements, found with OSSFuzz</a></li> <li><a href="https://github.com/tdewolff/minify/commit/6baf85e09105bad3ab9c56cabd71b16b225b778a">JS: fix cases of slow parsing of JS, see</a> <a href="https://redirect.github.com/tdewolff/parse/issues/132">tdewolff/parse#132</a></li> <li><a href="https://github.com/tdewolff/minify/commit/f9983640102d7a037577c53ffc37cbe1bb14a436">JS: fix appearance of script end tag or comment tag in regular expressions; don't stop minifying regexp when encountering slash in class</a></li> <li><a href="https://github.com/tdewolff/minify/commit/f2e65c379a671f5ec41fcaf260e2681c819d2aa0">Update dependencies, require go1.26 due to golang.org/x/sys</a></li> </ul> <h2>v2.24.19</h2> <ul> <li><a href="https://github.com/tdewolff/minify/commit/b520b95b2534767d3410189ab1685154c5b6bf01">JS: security fix for escape  or  inside HTML script tag case-insensitively</a></li> <li><a href="https://github.com/tdewolff/minify/commit/a0a31948fe6cba71f027e818321be8ccb5cfd006">Undo reuse of input byte slice in Minify.Bytes and Minify.String, it may cause problems if a minifier outputs longer output (rarely if never the case)</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tdewolff/minify/commit/d78bc7d3a1df188cfb1e820ce01563785a8f2c6a"><code>d78bc7d</code></a> Fix Python workflow, fixes <a href="https://redirect.github.com/tdewolff/minify/issues/1056">#1056</a></li> <li><a href="https://github.com/tdewolff/minify/commit/8bd401c7bfdb94d2c1b0b2f0e6705e4cb792b9a5"><code>8bd401c</code></a> HTML/JS: escape </script without immediately closing > in JS embedded in HTML</li> <li><a href="https://github.com/tdewolff/minify/commit/7599c9e11cffdc9e5f23eeb801660b03b471d0b8"><code>7599c9e</code></a> Merge pull request <a href="https://redirect.github.com/tdewolff/minify/issues/1054">#1054</a> from tdewolff/dependabot/github_actions/pypa/cibuild...</li> <li><a href="https://github.com/tdewolff/minify/commit/a89cc4784cee48e7656a96fd9adfe9b45b5c8403"><code>a89cc47</code></a> HTML: support nested <svg>'s and <math>'s, fixes <a href="https://redirect.github.com/tdewolff/minify/issues/1055">#1055</a></li> <li><a href="https://github.com/tdewolff/minify/commit/50ea57c43b57dfb58903c70249404ebf2940e4f5"><code>50ea57c</code></a> Fix Python workflow, fixes <a href="https://redirect.github.com/tdewolff/minify/issues/1056">#1056</a></li> <li><a href="https://github.com/tdewolff/minify/commit/8c16699dd5c877c78e0b1095ffc595b910046140"><code>8c16699</code></a> Bump pypa/cibuildwheel from 4.2.1 to 4.3.1</li> <li><a href="https://github.com/tdewolff/minify/commit/cf8d180aef2b9cf6dc63b811fc98704ea7549024"><code>cf8d180</code></a> Merge branch 'master' of github.com:tdewolff/minify</li> <li><a href="https://github.com/tdewolff/minify/commit/dfaa933b79ec00ba13b117696953b28adb81bf05"><code>dfaa933</code></a> JS: fix timing bug or endless loop for some input</li> <li><a href="https://github.com/tdewolff/minify/commit/bcdb5dc7577338b9302b55fe973d375e2141e8da"><code>bcdb5dc</code></a> Merge pull request <a href="https://redirect.github.com/tdewolff/minify/issues/1050">#1050</a> from tdewolff/dependabot/npm_and_yarn/bindings/js/ty...</li> <li><a href="https://github.com/tdewolff/minify/commit/25b7bd8e3f0cfbf043b406ef0329b68a4d8ccc53"><code>25b7bd8</code></a> Merge pull request <a href="https://redirect.github.com/tdewolff/minify/issues/1051">#1051</a> from tdewolff/dependabot/npm_and_yarn/bindings/js/vi...</li> <li>Additional commits viewable in <a href="https://github.com/tdewolff/minify/compare/v2.24.17...v2.24.24">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/tdewolff/minify/v2&package-manager=go_modules&previous-version=2.24.17&new-version=2.24.24)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>