[Snyk] Upgrade gulp from 5.0.0 to 5.0.1

[mnk-blr]

Snyk has created this PR to upgrade gulp from 5.0.0 to 5.0.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 1 version ahead of your current version.

• The recommended version was released 8 months ago.

Release notes

Package name: gulp

• 5.0.1 - 2025-06-01
  

  Bug Fixes

  • Avoid globbing before read stream is opened (#2839) (19122f3)
  • Avoid Node.js deprecation warning for fs.Stats (#2838) (69a5d0e)
  • Support top-level await on Node 22.12+ (#2836) (04b4a74)
• 5.0.0 - 2024-03-29
  

  We've tried to provide a high-level changelog for gulp v5 below, but it
  doesn't contain all changes from the 60+ dependencies that we maintain.

  Please see individual changelogs to drill down
  into all changes that were made.

  ⚠ BREAKING CHANGES

  • Drop support for Node.js <10.13
  • Default stream encoding to UTF-8
  • Standardized on anymatch library for globbing paths. All globs should work the same between src and watch now!
  • Removed support for ordered globs. This aligns with the chokidar globbing implementation. If you need your globs to be ordered, you can use ordered-read-stream
  • All globs and paths are normalized to unix-like filepaths
  • Only allow JS variants for .gulp.* config files
  • Removed support for alpha releases of v4 from gulp-cli
  • Removed the --verify flag
  • Renamed the --require flag to --preload to avoid conflicting with Node.js flags
  • Removed many legacy and deprecated loaders
  • Upgrade to chokidar v3
  • Clone Vinyl objects with stream contents using teex, but no longer wait for all streams to flow before cloned streams will receive data
  • Stop using process.umask() to make directories, instead falling back to Node's default mode
  • Throw on non-function, non-string option coercers
  • Drop support of Node.js snake_case flags
  • Use a Symbol for attaching the gulplog namespace to the store
  • Use a Symbol for attaching the gulplog store to the global
  • Use sha256 to hash the v8flags cache into a filename

  Features

  • Streamlined the dependency tree
  • Switch all streams implementation to Streamx
  • Rewrote glob-stream to use a custom directory walk that relies on newer Node.js features and is more performant than old implementation
  • Implement translation support for all CLI messages and all messages passing through gulplog
  • Allow users to customize or remove the timestamp from their logs
  • Upgraded gulplog to v2. Messages logged via v1 will also display a deprecated warning. Plugins should update to v2 as the community upgrades to gulp 5
  • Added support for gulpile.cjs and gulpfile.mjs
  • Add support for swc, esbuild, sucrase, and mdx loaders
  • Provide an ESM export (#2760) (b00de68)
  • Support sourcemap handling on streaming Vinyl contents
  • Support extends syntax for .gulp.* config file
  • Allow overriding gulpfile and preloads via .gulp.* config file

  Bug Fixes

  • Resolve bugs related to symlinks on various platforms
  • Resolved some reported ReDoS CVEs and improved performance in glob-parent
  • Rework errors surfaced when encountering files or symlinks when trying to create directories
  • Ensure watch allows japanese characters in globs (72668c6)
  • Ensure watch does not trigger on negated globs (72668c6)
  • Improve handling of BOM at the beginning of a stream
  • Properly handle function coercer in array of option coercers
  • Fork to-absolute-glob to:
    • Check negative patterns before trimming
    • Ensure glob-like characters are escaped in cwd & root options
    • Resolve ../ at the beginning of globs

  Miscellaneous Chores

  • Remove lazystream dependency
  • Updated various stream test suites to test against Node.js core stream, readable-stream, and streamx
  • Normalize repository, dropping node <10.13 support (#2758) (72668c6)

  Individual Changelogs

  We created and maintain various projects that gulp depends upon. You can find their changelogs linked below:

  • undertaker
  • vinyl-fs
  • glob-stream
  • gulp-cli
  • interpret
  • glob-parent
  • glob-watcher
  • vinyl
  • fs-mkdirp-stream
  • lead
  • vinyl-sourcemap
  • to-through
  • resolve-options
  • remove-bom-stream
  • value-or-function
  • now-and-later
  • @ gulpjs/to-absolute-glob
  • fined
  • mute-stdout
  • semver-greatest-satisfied-range
  • flagged-respawn
  • rechoir
  • gulplog
  • glogg
  • @ gulpjs/messages
  • sparkles
  • liftoff
  • v8flags
  • bach
  • undertaker-registry
  • async-settle
  • last-run
  • async-done
  • replace-homedir

from gulp GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[mnk-blr]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.