[Snyk] Upgrade gulp from 4.0.2 to 5.0.1

[snyk-io]

Snyk has created this PR to upgrade gulp from 4.0.2 to 5.0.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

• The recommended version is 2 versions ahead of your current version.

• The recommended version was released 3 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	589	No Known Exploit

Release notes

Package name: gulp

• 5.0.1 - 2025-06-01
  

  Bug Fixes

  • Avoid globbing before read stream is opened (#2839) (19122f3)
  • Avoid Node.js deprecation warning for fs.Stats (#2838) (69a5d0e)
  • Support top-level await on Node 22.12+ (#2836) (04b4a74)
• 5.0.0 - 2024-03-29
  

  We've tried to provide a high-level changelog for gulp v5 below, but it
  doesn't contain all changes from the 60+ dependencies that we maintain.

  Please see individual changelogs to drill down
  into all changes that were made.

  ⚠ BREAKING CHANGES

  • Drop support for Node.js <10.13
  • Default stream encoding to UTF-8
  • Standardized on anymatch library for globbing paths. All globs should work the same between src and watch now!
  • Removed support for ordered globs. This aligns with the chokidar globbing implementation. If you need your globs to be ordered, you can use ordered-read-stream
  • All globs and paths are normalized to unix-like filepaths
  • Only allow JS variants for .gulp.* config files
  • Removed support for alpha releases of v4 from gulp-cli
  • Removed the --verify flag
  • Renamed the --require flag to --preload to avoid conflicting with Node.js flags
  • Removed many legacy and deprecated loaders
  • Upgrade to chokidar v3
  • Clone Vinyl objects with stream contents using teex, but no longer wait for all streams to flow before cloned streams will receive data
  • Stop using process.umask() to make directories, instead falling back to Node's default mode
  • Throw on non-function, non-string option coercers
  • Drop support of Node.js snake_case flags
  • Use a Symbol for attaching the gulplog namespace to the store
  • Use a Symbol for attaching the gulplog store to the global
  • Use sha256 to hash the v8flags cache into a filename

  Features

  • Streamlined the dependency tree
  • Switch all streams implementation to Streamx
  • Rewrote glob-stream to use a custom directory walk that relies on newer Node.js features and is more performant than old implementation
  • Implement translation support for all CLI messages and all messages passing through gulplog
  • Allow users to customize or remove the timestamp from their logs
  • Upgraded gulplog to v2. Messages logged via v1 will also display a deprecated warning. Plugins should update to v2 as the community upgrades to gulp 5
  • Added support for gulpile.cjs and gulpfile.mjs
  • Add support for swc, esbuild, sucrase, and mdx loaders
  • Provide an ESM export (#2760) (b00de68)
  • Support sourcemap handling on streaming Vinyl contents
  • Support extends syntax for .gulp.* config file
  • Allow overriding gulpfile and preloads via .gulp.* config file

  Bug Fixes

  • Resolve bugs related to symlinks on various platforms
  • Resolved some reported ReDoS CVEs and improved performance in glob-parent
  • Rework errors surfaced when encountering files or symlinks when trying to create directories
  • Ensure watch allows japanese characters in globs (72668c6)
  • Ensure watch does not trigger on negated globs (72668c6)
  • Improve handling of BOM at the beginning of a stream
  • Properly handle function coercer in array of option coercers
  • Fork to-absolute-glob to:
    • Check negative patterns before trimming
    • Ensure glob-like characters are escaped in cwd & root options
    • Resolve ../ at the beginning of globs

  Miscellaneous Chores

  • Remove lazystream dependency
  • Updated various stream test suites to test against Node.js core stream, readable-stream, and streamx
  • Normalize repository, dropping node <10.13 support (#2758) (72668c6)

  Individual Changelogs

  We created and maintain various projects that gulp depends upon. You can find their changelogs linked below:

  • undertaker
  • vinyl-fs
  • glob-stream
  • gulp-cli
  • interpret
  • glob-parent
  • glob-watcher
  • vinyl
  • fs-mkdirp-stream
  • lead
  • vinyl-sourcemap
  • to-through
  • resolve-options
  • remove-bom-stream
  • value-or-function
  • now-and-later
  • @ gulpjs/to-absolute-glob
  • fined
  • mute-stdout
  • semver-greatest-satisfied-range
  • flagged-respawn
  • rechoir
  • gulplog
  • glogg
  • @ gulpjs/messages
  • sparkles
  • liftoff
  • v8flags
  • bach
  • undertaker-registry
  • async-settle
  • last-run
  • async-done
  • replace-homedir
• 4.0.2 - 2019-05-06
  

  Fix

  • Bind src/dest/symlink to the gulp instance to support esm exports (5667666) - Ref standard-things/esm#797

  Docs

  • Add notes about esm support (4091bd3) - Closes #2278
  • Fix the Negative Globs section & examples (3c66d95) - Closes #2297
  • Remove next tag from recipes (1693a11) - Closes #2277
  • Add default task wrappers to Watching Files examples to make runnable (d916276) - Closes #2322
  • Fix syntax error in lastRun API docs (ea52a92) - Closes #2315
  • Fix typo in Explaining Globs (5d81f42) - Closes #2326

  Build

  • Add node 12 to Travis & Azure (b4b5a68)

from gulp GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[snyk-io]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)