Bump minimatch, @ckeditor/ckeditor5-dev-utils and twig

[dependabot]

Bumps minimatch to 3.1.5 and updates ancestor dependencies minimatch, @ckeditor/ckeditor5-dev-utils and twig. These dependencies need to be updated together.

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates @ckeditor/ckeditor5-dev-utils from 43.1.0 to 55.0.0

Release notes

Sourced from @​ckeditor/ckeditor5-dev-utils's releases.

v55.0.0

MAJOR BREAKING CHANGES ℹ️

• tests, utils: Remove tools used to handle and generate DLLs for “old installation methods” in CKEditor 5. See ckeditor/ckeditor5#17779.
• utils: The styles.themeImporter() helper is no longer available.
• Upgrade TypeScript to v5.5.4.

MINOR BREAKING CHANGES ℹ️

• build-tools, utils: Remove support for PostCSS mixins, as they are no longer used in CKEditor 5 codebase.
• build-tools, utils: Following our migration away from PostCSS features, we have replaced PostCSS with LightningCSS in our build tools. This changes the specificity of the generated CSS selectors, which now reflect how native CSS nesting works.
• utils: Remove the styles export from the ckeditor5-dev-utils package.

Features

• release-tools: Added a disallowLatestNpmTag option to publishPackages() and npm tag validation so release workflows can explicitly block publishing with the latest dist-tag. Closes ckeditor/ckeditor5#19952.

  When enabled, attempting to publish with npmTag: 'latest' now fails before publishing starts.

Bug fixes

• build-tools: Fixed the build() function producing duplicated banners outside the translations directory.
• build-tools: Improve detection of the nested ck-content classes, so that *-content.css stylesheets contain all the necessary styles.

Other changes

• tests: The testing environment no longer consumes the themePath option in both test runner tasks.

  Previously themePath was hardcoded to @ckeditor/ckeditor5-theme-lark.

Released packages

Check out the Versioning policy guide for more information.

Major releases (contain major breaking changes):

• @​ckeditor/ckeditor5-dev-tests: v55.0.0-alpha.5 => v55.0.0
• @​ckeditor/ckeditor5-dev-utils: v55.0.0-alpha.5 => v55.0.0

Minor releases (contain minor breaking changes):

• @​ckeditor/ckeditor5-dev-build-tools: v55.0.0-alpha.5 => v55.0.0

Releases containing new features:

• @​ckeditor/ckeditor5-dev-release-tools: v55.0.0-alpha.5 => v55.0.0

... (truncated)

Changelog

Sourced from @​ckeditor/ckeditor5-dev-utils's changelog.

55.0.0 (March 12, 2026)

MAJOR BREAKING CHANGES ℹ️

• tests, utils: Remove tools used to handle and generate DLLs for “old installation methods” in CKEditor 5. See ckeditor/ckeditor5#17779.
• utils: The styles.themeImporter() helper is no longer available.
• Upgrade TypeScript to v5.5.4.

MINOR BREAKING CHANGES ℹ️

• build-tools, utils: Remove support for PostCSS mixins, as they are no longer used in CKEditor 5 codebase.
• build-tools, utils: Following our migration away from PostCSS features, we have replaced PostCSS with LightningCSS in our build tools. This changes the specificity of the generated CSS selectors, which now reflect how native CSS nesting works.
• utils: Remove the styles export from the ckeditor5-dev-utils package.

Features

• release-tools: Added a disallowLatestNpmTag option to publishPackages() and npm tag validation so release workflows can explicitly block publishing with the latest dist-tag. Closes ckeditor/ckeditor5#19952.

  When enabled, attempting to publish with npmTag: 'latest' now fails before publishing starts.

Bug fixes

• build-tools: Fixed the build() function producing duplicated banners outside the translations directory.
• build-tools: Improve detection of the nested ck-content classes, so that *-content.css stylesheets contain all the necessary styles.

Other changes

• tests: The testing environment no longer consumes the themePath option in both test runner tasks.

  Previously themePath was hardcoded to @ckeditor/ckeditor5-theme-lark.

• This is a sync release that brings changes from v54.3.4 to the @alpha channel (v55.0.0-alpha.4).

Released packages

Check out the Versioning policy guide for more information.

Major releases (contain major breaking changes):

• @​ckeditor/ckeditor5-dev-tests: v55.0.0-alpha.5 => v55.0.0
• @​ckeditor/ckeditor5-dev-utils: v55.0.0-alpha.5 => v55.0.0

Minor releases (contain minor breaking changes):

• @​ckeditor/ckeditor5-dev-build-tools: v55.0.0-alpha.5 => v55.0.0

Releases containing new features:

... (truncated)

Commits

• 3edb150 Release: v55.0.0. [skip ci]
• 5efaa92 Ensure @import-ed CSS is processed by Lightning CSS in dev-utils.
• dafe99b lightningCssOptions should not override hardcoded properties.
• 0c55d2b Remove unused code and unnecessary abstractions.
• dd8d57a Remove unused file.
• e3de2a8 Generate separate chunk for LightningCSS loader.
• 9909637 Forward LightningCSS warnings to Rollup.
• 24f6865 Replace postcss with lightningcss in ckeditor5-dev-utils.
• 585cd06 Removed unused mocks in tests.
• 924020b Merge branch 'master' into epic/ci/4168-drop-oim
• Additional commits viewable in compare view

Updates twig from 1.17.1 to 2.0.0

Release notes

Sourced from twig's releases.

v2.0.0

Breaking Changes

• Ensure you are using Node.js >= 20

What's Changed

• Write docs using vitepress by @​ajiho in twigjs/twig.js#898
• Allow whitespace in extended ternary operator for false conditions. by @​antoineveldhoven in twigjs/twig.js#911
• Bump brace-expansion from 1.1.11 to 1.1.12 by @​dependabot[bot] in twigjs/twig.js#915
• Bump locutus from 2.0.15 to 2.0.39 by @​dependabot[bot] in twigjs/twig.js#925
• Bump lodash from 4.17.21 to 4.17.23 by @​dependabot[bot] in twigjs/twig.js#924
• Bump webpack from 5.75.0 to 5.105.0 by @​dependabot[bot] in twigjs/twig.js#926
• Update dependencies and lower attatck surface by @​thomashohn in twigjs/twig.js#928
• Bump rollup from 4.24.3 to 4.59.0 in /docs by @​dependabot[bot] in twigjs/twig.js#933
• Run npm audit fix by @​thomashohn in twigjs/twig.js#935
• Update sinon and webpack-cli by @​thomashohn in twigjs/twig.js#936
• Add a UPGRADING.md for Breaking Changes by @​RobLoach in twigjs/twig.js#932
• [TASK] Use eslint instead of outdated xo by @​thomashohn in twigjs/twig.js#938
• [TASK] Update locutus to ^3 by @​thomashohn in twigjs/twig.js#940

New Contributors

• @​ajiho made their first contribution in twigjs/twig.js#898
• @​thomashohn made their first contribution in twigjs/twig.js#928

Full Changelog: twigjs/twig.js@v1.17.1...v2.0.0

Commits

• d19c212 v2.0.0
• 31e9f45 Merge pull request #940 from thomashohn/task/update-locutus
• bb9c440 Require locutus:^3.0.9
• 78ffa88 Updated packages to latest versions
• a083fa9 Merge branch 'master' into task/update-locutus
• b6d1766 Merge branch 'twigjs:master' into master
• e863fd5 Merge pull request #938 from thomashohn/task/replace-xo-with-eslint-937
• 845f205 Update locutus to ^3
• d419ef2 Revert "Update locutus to ^3"
• ee32ab5 Update locutus to ^3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.