Bump juice from 11.1.1 to 12.1.2 in /web

[dependabot]

Bumps juice from 11.1.1 to 12.1.2.

Release notes

Sourced from juice's releases.

v12.1.2

• fix: prevent ReDoS in css variable parsing c2f09d5
• docs: remove cheerio/mensch/slick from 3rd-party section 8c4e15e
• build(deps): bump undici from 7.28.0 to 7.29.0 ceb1a71
• build(deps-dev): bump @​types/node from 26.1.1 to 26.1.2 5a4c958
• build(deps): bump postcss from 8.5.23 to 8.5.25 8861a6a
• build(deps): bump postcss-nesting from 14.0.0 to 14.0.1 94e630b
• build(deps-dev): bump vitest from 4.1.9 to 4.1.10 724b5c6

---

Automattic/juice@v12.1.1...v12.1.2

v12.1.1

• build(deps-dev): bump vitest from 4.1.8 to 4.1.9 29e9e67
• build(deps): bump postcss-selector-parser from 7.1.1 to 7.1.4 a988791
• build(deps-dev): bump @​types/node from 25.9.2 to 25.9.3 9baacd5

---

Automattic/juice@v12.1.0...v12.1.1

v12.1.0

• feat: add data-juice-important attribute 7cb46ac

---

Automattic/juice@v12.0.0...v12.1.0

v12.0.0

Juice 12

Modernizes the entire stack: ESM-only, PostCSS-based parsers to support CSS Nesting + spec-correct selector specificity, Node 22.12+ floor, Vitest 4.

Breaking changes

• Juice is now ESM-only. CJS consumers on Node ≥ 22.12 keep working transparently via Node's built-in require(esm) interop. Older Node versions need to upgrade.
• Node ≥ 22.12.0 required. Drops support for Node 18 and Node 20. CI matrix is now Node 22, 24, 26.
• Browser: client.js is ESM. Modern bundlers (Vite, webpack 5, esbuild, Rollup, Parcel 2+) handle it via the "browser" condition in the exports map. Browserify is no longer supported, it cannot parse ESM. README updated to point at modern bundlers.
• CSS parser swapped: mensch → postcss + postcss-safe-parser. Selector parser swapped: slick → postcss-selector-parser. Both old libs were unmaintained since 2022. Inlining semantics unchanged; preserved-CSS output inside <style> blocks is now canonically formatted (mensch had quirks like ;} squashed onto one line). 4 fixture .out files refreshed to match.
• Spec-correct selector specificity for :is(), :where(), :has(), :not() per CSS Selectors Level 4: :where(...) contributes 0, the others contribute max(spec(args)). Previously juice treated all four as a generic :pseudo and :not used "first arg only" (a slick legacy). Any cascade resolution that depended on the old quirks will produce different inlined styles.
• commander upgraded to v14, entities upgraded to v8 (ESM-only), cheerio pinned to 1.2.0.
• TypeScript declarations renamed juice.d.ts → index.d.ts and restructured for ESM default-export resolution. Import as import juice from 'juice'.

New features

• CSS Nesting (Level 1) is supported. Nested rules (.card { &:hover { ... } }), nested at-rules (.card { @media (...) { ... } }), the & parent selector, and bare nested selectors (per the 2023 CSSWG resolution) are flattened via postcss-nesting before inlining. Previously these were silently dropped. No behavior change for already-flat CSS.
• @container and @layer at-rules are preserved through inlining (mirrors how @media/@font-face/@keyframes already worked). New options preserveContainerQueries and preserveLayers default to true.

... (truncated)

Changelog

Sourced from juice's changelog.

Unreleased

Breaking changes

• Juice is now ESM-only. Consumers using require('juice') from CJS on Node ≥ 22.12 will continue to work via Node's built-in require(esm) interop. CJS consumers on older Node versions will need to migrate to import or upgrade Node.
• Node ≥ 22.12.0 required. Dropped support for Node 18 and Node 20. CI now runs on Node 22, 24, and 26.
• Browser: the package's client.js entry is now ESM. Modern bundlers (Vite, webpack 5, esbuild, Rollup, Parcel 2+) handle it transparently via the "browser" condition in exports. Browserify is no longer supported — it cannot parse ESM.
• CSS parser replaced: mensch → postcss + postcss-safe-parser. Selector parser replaced: slick → postcss-selector-parser. Both old libs were unmaintained since 2022 and mis-handled modern CSS. Inlining behaviour is unchanged; preserved-CSS output inside <style> blocks is now canonically formatted (fixes mensch quirks like ;} squashed on one line and 0%,\n100% selector splits).
• Specificity is now spec-correct for :is(), :where(), :has(), and :not() (CSS Selectors Level 4). :where(...) contributes 0; :is(...), :has(...), and :not(...) contribute the maximum specificity across their arguments. Previously juice treated all four as a generic :pseudo and :not used "first argument only" (a slick legacy). Any cascade resolution that depended on the old quirks will produce different inlined styles.
• @container and @layer at-rules are now preserved through inlining (mirroring @media / @font-face / @keyframes). New options preserveContainerQueries and preserveLayers default to true; pass false to drop them. Note: @layer is preserved verbatim only — layer-aware cascade resolution is not implemented (email clients don't support layers anyway).
• CSS Nesting is now supported. Nested rules (.card { &:hover { ... } }), nested at-rules (.card { @media (min-width: 600px) { ... } }), and the & parent selector are flattened via postcss-nesting before inlining. Previously, nested rules were silently dropped during parsing. No behaviour change for already-flat CSS.
• commander upgraded to v14. Positional CLI arguments are now declared explicitly via .argument() (commander v14 errors on excess undeclared args).
• entities upgraded to v8 (ESM-only).
• cheerio pinned to 1.2.0.
• TypeScript declarations renamed juice.d.ts → index.d.ts and restructured for ESM default-export resolution (import juice from 'juice').
• Test runner migrated from Mocha to Vitest 4.

Tooling

• npm test now runs vitest run --coverage && npm run test-typescript.
• New npm run coverage script using @vitest/coverage-v8 (replaces the previously broken testcover script).
• New npm run test:watch for interactive development.
• Test files renamed: test/cli.js → test/cli.test.js, test/test.js → test/integration.test.js, test/run.js → test/cases.test.js.
• bin/juice extracted: the CLI logic now lives in lib/cli.js as a testable cli.run(argv, deps) function with dependency injection. The bin itself is a 3-line ESM shim.
• TypeScript test now uses a dedicated test/typescript/tsconfig.json with nodenext module resolution.
• Removed devDependencies: mocha, should, batch, browserify. Added: vitest, @vitest/coverage-v8.
• package.json now declares "type": "module" and an "exports" map with types / browser / default conditions.

Commits

• 8036990 12.1.2
• c2f09d5 fix: prevent ReDoS in css variable parsing
• 8c4e15e docs: remove cheerio/mensch/slick from 3rd-party section
• 8b83cee Merge pull request #642 from Automattic/dependabot/npm_and_yarn/undici-7.29.0
• ceb1a71 build(deps): bump undici from 7.28.0 to 7.29.0
• e728f2c Merge pull request #641 from Automattic/dependabot/npm_and_yarn/types/node-26...
• 3f69f2e Merge pull request #640 from Automattic/dependabot/npm_and_yarn/postcss-8.5.25
• 5a4c958 build(deps-dev): bump @​types/node from 26.1.1 to 26.1.2
• 8861a6a build(deps): bump postcss from 8.5.23 to 8.5.25
• 7cb7f58 Merge pull request #639 from Automattic/dependabot/npm_and_yarn/postcss-8.5.23
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.