Skip to content

Bump postcss from 8.4.49 to 8.5.10 - #1

Open
dependabot[bot] wants to merge 4 commits into
masterfrom
dependabot/npm_and_yarn/postcss-8.5.10
Open

Bump postcss from 8.4.49 to 8.5.10#1
dependabot[bot] wants to merge 4 commits into
masterfrom
dependabot/npm_and_yarn/postcss-8.5.10

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 4, 2026

Copy link
Copy Markdown

Bumps postcss from 8.4.49 to 8.5.10.

Release notes

Sourced from postcss's releases.

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

  • Fixed ContainerWithChildren type discriminating (by @​Goodwine).

8.5.5

  • Fixed package.jsonexports compatibility with some tools (by @​JounQin).

8.5.4

8.5.3

8.5.2

8.5.1

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@​romainmenke during his work on Stylelint added Input#document in additional to Input#css.

root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"
</tr></table>

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

  • Fixed ContainerWithChildren type discriminating (by @​Goodwine).

8.5.5

  • Fixed package.jsonexports compatibility with some tools (by @​JounQin).

8.5.4

8.5.3

8.5.2

8.5.1

8.5 “Duke Alloces”

  • Added Input#document for sources like CSS-in-JS or HTML (by @​romainmenke).
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 4, 2026
sciyoshi and others added 4 commits May 4, 2026 20:46
GitHub Packages requires scoped names matching the publishing org. Rename
the top-level package and the eleven platform-specific binary packages from
'lightningcss[-platform]' to '@fellowapp/lightningcss[-platform]', update
node/index.js to require the scoped platform package at runtime, and point
publishConfig.registry at https://npm.pkg.github.com.

Drop CLI packaging from build-npm.js — the fork is consumed as a library
(via Vite/lightningcss-napi), not as a CLI, and the per-platform CLI
bundles are dead weight.

Version bumped to 1.32.0-fellow.0 so the fork doesn't shadow upstream.
Adapted from .github/workflows/release.yml. Builds the same matrix of
platform-specific .node binaries (10 targets: macOS x64/arm64, Windows
x64/arm64, Linux x64/arm64 gnu+musl, Linux armv7, Android arm64) and
publishes them to GitHub Packages as @fellowapp/lightningcss-<platform>,
plus the main @fellowapp/lightningcss package.

Differences from the upstream workflow:
- Triggered on workflow_dispatch only (no automated tag-based release).
- Drops FreeBSD and wasm targets (not needed for the Vite-via-napi use case).
- Drops CLI build/publish (the fork is consumed as a library).
- Authenticates with GITHUB_TOKEN against npm.pkg.github.com via
  setup-node's registry-url + scope inputs.
- Requires permissions: { packages: write, contents: read } on the
  release job.
Fellow fork: css-modules webpack-parity hashing + GH Packages publishing
Bumps [postcss](https://github.com/postcss/postcss) from 8.4.49 to 8.5.10.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.49...8.5.10)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.10
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/postcss-8.5.10 branch from b0b8324 to c675fb7 Compare May 5, 2026 00:51
@dependabot @github

dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown
Author

A newer version of postcss exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant