Bump the patch-releases group across 2 directories with 3 updates

[dependabot]

Bumps the patch-releases group with 2 updates in the / directory: autoprefixer and postcss.
Bumps the patch-releases group with 1 update in the /dumper-companion directory: @zip.js/zip.js.

Updates autoprefixer from 10.5.2 to 10.5.4

Release notes

Sourced from autoprefixer's releases.

10.5.4

• Fixed prefixed rule duplication (by @​xianjianlf2).

10.5.3

• Fixed brackets and gradient parser (@​alanturing881).

Changelog

Sourced from autoprefixer's changelog.

10.5.4

• Fixed prefixed rule duplication (by @​xianjianlf2).

10.5.3

• Fixed brackets and gradient parser (@​alanturing881).

Commits

• 4cad00f Release 10.5.4 version
• e62a4b1 Update CI config
• c8f0d0a Update dependencies
• cae3577 Move back to latest pnpm 11
• fd31eb3 Fix duplicated prefixed selectors on reformatted CSS (#1552)
• 958d390 Release 10.5.3 version
• 21d2adb Fix gradient parser
• f7ddae9 Fix bracket parser
• 10ea5e7 Update dependencies and remove patch
• b6e8a2a Update Dev Container
• Additional commits viewable in compare view

Updates postcss from 8.5.16 to 8.5.19

Release notes

Sourced from postcss's releases.

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Changelog

Sourced from postcss's changelog.

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Commits

• 9543b22 Release 8.5.19 version
• 3d13bf9 Fix CI on Windows too
• 00d0dd2 Keep explicitly set raws.before when inserting nodes into root (#2111)
• 7a05b33 Temporary fix CI
• 4c0d194 Release 8.5.18 version
• 92b4e78 Update dependencies
• 95663d3 Limit where source map can be loaded for security reasons
• 74e25ae Release 8.5.17 version
• d1518af Fix Maximum call stack size exceeded error
• 2421312 Fix linter
• Additional commits viewable in compare view

Updates @zip.js/zip.js from 2.8.26 to 2.8.31

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.8.31

New features

• Accept a non-constructable reader (a factory function, not only a Reader class) as the Reader of a ZipFileEntry/ZipDirectoryEntry; the reader is now invoked with or without new depending on whether it exposes a prototype.
• Export the ERR_ITERATOR_COMPLETED_TOO_SOON and ERR_WRITER_NOT_INITIALIZED error constants.

Bug fixes

• Add a dedicated index.d.cts so TypeScript resolves the correct types for the CommonJS entry point instead of falling back to the ESM declarations.
• Fix invalid entries in the MIME type table: drop the bogus x-font/pcf.Z and duplicate video/avif entries, correct the mis-keyed application/x-ms-installer (msi), and map image/avif to both avif and avifs.
• Align the JavaScript zlib module with the windowBits: -16 raw-stream convention.

Performance

• Build the MIME type map lazily from a compact JSON payload, so the table is only parsed when a MIME type is actually requested.
• Shrink the WebAssembly zlib module by ~8 KB (~16%) by merging the deflate64 path into the inflate code and generating the deflate trees at runtime.
• Reduce bundle size by mangling internal property names and shipping inline worker payloads deflate-compressed.

v2.8.30

New features

• Add the strictness option ("strict" | "balanced" | "tolerant", default "balanced") and maxAppendedDataSize option to ZipReader, controlling how appended data, prepended stubs, and ambiguous end-of-central-directory records are handled. checkAmbiguity: true is now an alias for "strict".
• Add createOPFSTempStream() and the createTempStream writer option to spill large buffered entries to the OPFS instead of memory, with an optional dispose() hook released on every exit path.
• Add FS#exportFileSystemHandle() and ZipDirectoryEntry#exportFileSystemHandle() to write an entry tree out to a FileSystemDirectoryHandle.

Security: End-of-central-directory selection

• Select the last end-anchored record that points to a central directory instead of the first signature scanned from the end; refuse genuine comment-cloak polyglots with ERR_AMBIGUOUS_ARCHIVE.
• Rank record reachability so empty or saturated bytes at the end of a comment can no longer forge a second record; genuine empty and zip64 archives still open.
• Prefer the reconciled central-directory offset over a stale one, so an identical-layout append remnant exposes the appended directory rather than the previous one.
• Apply the reachability check to the fallback scan, so a stray signature in appended data no longer hijacks recovery under tolerant. Security
• Bound the reachability probes to prevent a comment stuffed with unreachable records from amplifying into thousands of (potentially remote) reads on random-access readers such as HttpRangeReader.

Performance

• Speed up CRC-32 with a slice-by-8 implementation and by harvesting the CRC from the gzip trailer on the native CompressionStream.

v2.8.29

Bug fixes

• Bounded memory when streaming large entries. The compression path now applies backpressure through the codec, pacing the input to the rate the compressor consumes it. Previously, writing a large entry could grow memory in proportion to the entry size — a 256 MB file peaked around 390 MB — because the platform's native CompressionStream does not apply writable backpressure in Node.js and Bun. Peak memory is now flat regardless of entry size (~99 MB for that same 256 MB file), with no throughput cost. (d18f4e3a)

• A provided zlib codec is no longer discarded when the WASM module is unavailable. If you supply a self-contained CompressionStreamZlib / DecompressionStreamZlib (e.g. the pure-JS port) with useCompressionStream: false and no WASM module (wasmURI: null, or a failed load), the library used to silently fall back to the native CompressionStream. Your codec is now honored; the native fallback applies only when the codec that would actually run depends on the WASM module. (a67c54e1)

Other

• Added a reproducible benchmark suite (benchmarks/) and BENCHMARKS.md comparing @zip.js/zip.js against jszip, fflate and archiver across compression, decompression and disk-to-disk streaming. (65178e72)
• Tests: the crypto error-path tests opt out of Deno's resource sanitizer, working around a Deno bug where cancelling a transferred, still-open ReadableStream leaks a MessagePort (reported upstream — denoland/deno#36015). (454f79ec)

v2.8.28

What's Changed

... (truncated)

Commits

• da7e2bd bump up vrsion
• 7ed62c8 update doc
• 7c729fa update built files
• 8ecf43b pass read window and chunkSize as createReadable args
• ca4520a update built files
• 9a47a43 update js zlib module with windowBits -16 convention
• ac42767 update built files
• 00c882e update zlib wasm module with runtime deflate trees
• 8e7296b update built files
• 891ab83 update zlib wasm module with merged deflate64 inflate
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions