Skip to content

Bump postcss from 8.4.49 to 8.5.23 - #1

Open
dependabot[bot] wants to merge 1 commit into
sassy-v6.1-newServerfrom
dependabot/npm_and_yarn/postcss-8.5.22
Open

Bump postcss from 8.4.49 to 8.5.23#1
dependabot[bot] wants to merge 1 commit into
sassy-v6.1-newServerfrom
dependabot/npm_and_yarn/postcss-8.5.22

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown

Bumps postcss from 8.4.49 to 8.5.23.

Release notes

Sourced from postcss's releases.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 23, 2026
@dependabot
dependabot Bot changed the base branch from sassy-v7.0 to sassy-v6.1 July 23, 2026 19:31
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/postcss-8.5.22 branch from 1e44687 to 2e77460 Compare July 23, 2026 19:31
@cooperka
cooperka force-pushed the sassy-v6.1 branch 4 times, most recently from 54266e1 to a02e014 Compare July 24, 2026 21:25
Bumps [postcss](https://github.com/postcss/postcss) from 8.4.49 to 8.5.23.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.49...8.5.23)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.22
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot changed the base branch from sassy-v6.1 to sassy-v6.1-newServer July 24, 2026 21:37
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/postcss-8.5.22 branch from 2e77460 to a4641c0 Compare July 24, 2026 21:37
@dependabot dependabot Bot changed the title Bump postcss from 8.4.49 to 8.5.22 Bump postcss from 8.4.49 to 8.5.23 Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants