Bump postcss from 8.4.31 to 8.5.24 by dependabot[bot] · Pull Request #1592 · blockprotocol/blockprotocol

dependabot · 2026-07-28T22:16:44Z

Bumps postcss from 8.4.31 to 8.5.24.

Release notes

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

... (truncated)

Commits

0ebe8ad Release 8.5.24 version
73218c6 Update dependencies
9a114f6 Preserve the BOM when stringifying (#2119)
9069261 Fix types check
eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [postcss](https://github.com/postcss/postcss) from 8.4.31 to 8.5.24. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.24) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.24 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

cursor · 2026-07-28T22:16:50Z

PR Summary

Low Risk
Dependency-only lockfile change within PostCSS 8.x; main impact is CSS processing at build time, with upstream security fixes rather than app logic changes.

Overview
Lockfile-only Dependabot bump that resolves postcss@^8.4.7 (used by the CSS build toolchain, e.g. css-loader) from 8.4.31 to 8.5.24. No application source or package.json changes.

The updated postcss entry pulls newer transitive versions (nanoid, picocolors, source-map-js), with matching yarn.lock deduplication for nanoid and source-map-js.

Upstream 8.5.x adds security hardening around source-map loading, parsing/AST fixes, and minor output behavior (e.g. BOM preservation). Reviewers should treat this as a build-time CSS processor upgrade and run the usual CSS/build checks if anything looks off.

^{Reviewed by Cursor Bugbot for commit dfc5a16. Bugbot is set up for automated code reviews on this repo. Configure here.}

dependabot · 2026-08-05T07:13:47Z

Superseded by #1595.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 28, 2026

dependabot Bot mentioned this pull request Jul 28, 2026

Bump postcss from 8.4.31 to 8.5.23 #1589

Closed

dependabot Bot closed this Aug 5, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/postcss-8.5.24 branch August 5, 2026 07:13

Navigation Menu

Uh oh!

Bump postcss from 8.4.31 to 8.5.24 - #1592

Bump postcss from 8.4.31 to 8.5.24#1592
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/postcss-8.5.24

dependabot Bot commented on behalf of github Jul 28, 2026

Uh oh!

cursor Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

Uh oh!

cursor Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

dependabot Bot commented on behalf of github Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

cursor Bot commented Jul 28, 2026 •

edited

Loading