Bump postcss, @fullhuman/postcss-purgecss, cssnano, postcss-cli, postcss-import, postcss-normalize and postcss-preset-env

[dependabot]

Bumps postcss to 8.5.19 and updates ancestor dependencies postcss, @fullhuman/postcss-purgecss, cssnano, postcss-cli, postcss-import, postcss-normalize and postcss-preset-env. These dependencies need to be updated together.

Updates postcss from 7.0.36 to 8.5.19

Release notes

Sourced from postcss's releases.

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

8.5.8

• Fixed Processor#version.

8.5.7

• Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

• Fixed ContainerWithChildren type discriminating (by @​Goodwine).

8.5.5

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

... (truncated)

Commits

• 9543b22 Release 8.5.19 version
• 3d13bf9 Fix CI on Windows too
• 00d0dd2 Keep explicitly set raws.before when inserting nodes into root (#2111)
• 7a05b33 Temporary fix CI
• 4c0d194 Release 8.5.18 version
• 92b4e78 Update dependencies
• 95663d3 Limit where source map can be loaded for security reasons
• 74e25ae Release 8.5.17 version
• d1518af Fix Maximum call stack size exceeded error
• 2421312 Fix linter
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates @fullhuman/postcss-purgecss from 3.0.0 to 3.1.3

Release notes

Sourced from @​fullhuman/postcss-purgecss's releases.

v3.1.3

Changes

• postcss-purgecss remove postcss 8 as peer dependency
• purgecss-webpack-plugin fix backward compatibility with webpack 4
• PurgeCSS Update to PostCSS 8
• postcss-purgecss Add compatibility with PostCSS 8
• purgecss-webpack-plugin Fix deprecation warning with Webpack 5

Bug Fixes

• ci update to postcss 8.2 (72302ff)
• safelist option in CLI (43dbe3c), closes #513

Changelog

Sourced from @​fullhuman/postcss-purgecss's changelog.

8.0.0

BREAKING CHANGES

• Revert the changes from v7.0.2 that modified the import of the PostCSS plugin. This was causing issues (see #1295. The PostCSS plugin should now be imported via a default import:

import purgeCSSPlugin from '@fullhuman/postcss-purgecss';

Features

• feat: add --preserve-paths option to CLI for maintaining folder hierarchy (aa5ac9d), closes #377

Bug fixes

• fix: for code scanning alert no. 5: Incomplete multi-character sanitization (#1403) (3f39411), closes #1403
• fix: enhance setOptions to support both ES modules and CommonJS config exports (4ad48c4), closes #1340
• fix: fix glob expression illegal operations on directories (#1308) (b27293f), closes #1308 #1266
• fix: update import statements for purgeCSSPlugin in documentation and source files (e5cbce2), closes #1295
• fix(#995): preserve relative paths in source maps (4f6c4d9), closes #995
• fix: enhance keyframes handling to preserve animations referenced via CSS variables (076c027), closes #478

Changes (commits since v7.0.2)

• Add French documentation for PurgeCSS guides and plugins (b9f4309)
• fix for "Workflow does not contain permissions" (eb6d3b8)
• fix(#995): preserve relative paths in source maps (4f6c4d9), closes #995
• v8.0.0 (2e315a5)
• chore: format (6c0c84e)
• chore: format (7ad2fb7)
• docs: add breaking changes for v7 about named export for postcss plugin (7d86fb5)
• docs: add changelog for v7 (bafb8a1)
• docs: add SEO enhancements and sitemap support to documentation (6505b7d)
• docs: remove outdated TailwindCSS sponsor image (3949790)
• docs: update sponsorship images and remove outdated link (bdf87e4)
• docs: use named export for postcss plugin (8eb027d)
• feat: add --preserve-paths option to CLI for maintaining folder hierarchy (aa5ac9d), closes #377
• feat: enhance keyframes handling to preserve animations referenced via CSS variables (076c027), closes #478
• build(deps-dev): bump @​eslint/eslintrc from 3.1.0 to 3.2.0 (#1303) (8308cdb), closes #1303
• build(deps-dev): bump @​eslint/js from 9.11.1 to 9.39.0 (#1391) (2348f82), closes #1391
• build(deps-dev): bump @​rollup/plugin-typescript from 12.1.0 to 12.1.2 (#1312) (9387a9b), closes #1312
• build(deps-dev): bump @​rollup/plugin-typescript from 12.1.2 to 12.3.0 (#1407) (5902189), closes #1407
• build(deps-dev): bump @​types/glob from 8.0.0 to 9.0.0 (#1408) (aa30f0f), closes #1408
• build(deps-dev): bump @​types/jest from 29.5.13 to 29.5.14 (#1301) (cb3d1c4), closes #1301
• build(deps-dev): bump @​types/node from 22.13.0 to 25.0.3 (#1406) (ca242ee), closes #1406
• build(deps-dev): bump @​types/node from 22.8.6 to 22.13.0 (#1322) (0d9f594), closes #1322
• build(deps-dev): bump @​typescript-eslint/parser from 8.14.0 to 8.46.2 (#1390) (67b5b0c), closes #1390
• build(deps-dev): bump @​vuepress/plugin-search (#1320) (00251a7), closes #1320
• build(deps-dev): bump @​vuepress/plugin-search (#1372) (307f8d2), closes #1372
• build(deps-dev): bump @​vuepress/theme-default (#1405) (047f0ea), closes #1405

... (truncated)

Commits

• 6ea98b6 build: 3.1.3
• 9ff20f3 chore: update changelog
• 48a8a48 build: 3.1.3 pre
• ff2eff5 fix(postcss-purgecss): remove postcss as peer dependency
• 96915f1 chore: update gitignore
• 5474af6 build(deps): bump commander from 6.2.0 to 6.2.1
• 6ed31d5 build: 3.1.2
• 501249c fix: check chunk.files type at runtime
• 30515c8 build(deps-dev): bump ts-jest from 26.4.2 to 26.4.4
• 9c83a15 build: 3.1.1
• Additional commits viewable in compare view

Updates cssnano from 4.1.10 to 8.0.2

Release notes

Sourced from cssnano's releases.

v8.0.2

What's Changed

• perf(postcss-unique-selectors): add fast paths for the common cases by @​dkryaklin in cssnano/cssnano#1813
• perf(postcss-discard-duplicates): bucket rules by selector by @​dkryaklin in cssnano/cssnano#1815
• perf(postcss-merge-longhand): skip processors with no relevant decls by @​dkryaklin in cssnano/cssnano#1814
• Include postcss-discard-overridden types in package by @​itosa-kazu in cssnano/cssnano#1817
• fix: preserve apostrophes in svg data uris by @​pupuking723 in cssnano/cssnano#1819

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.1...cssnano@8.0.2

v8.0.1

What's Changed

• fix(postcss-minify-selectors): reject :is() fold when divergent middle contains a combinator under a non-empty prefix (closes #1786) by @​dkryaklin in cssnano/cssnano#1798
• fix(postcss-minify-selectors): tighten :is() fold acceptance to a strict allowlist by @​dkryaklin in cssnano/cssnano#1799

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.0...cssnano@8.0.1

v8.0.0

What's Changed

• Move declaration sorter to advanced preset by @​ludofischer and @​Goodwine in cssnano/cssnano#1793
• Drop node 20 by @​ludofischer in cssnano/cssnano#1794

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.9...cssnano@8.0.0

v7.1.9

Bug Fixes

• Reject :is() fold for unknown pseudo-classes with arguments by @​dkryaklin in cssnano/cssnano#1791

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.8...cssnano@7.1.9

v7.1.8

What's Changed

• fix(postcss-minify-selectors): reject :is() fold for :nth-child(... of S) to preserve cascade by @​dkryaklin in cssnano/cssnano#1785
• Update postcss and @​colordx/core by @​ludofischer in cssnano/cssnano#1786

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.7...cssnano@7.1.8

v.7.1.7

This release is idnetical to the previous one, but is being published to ensure that the latest versions of postcss-normalize-repeat-style and postcss-normalize-positions are uploaded to the npm registry.

... (truncated)

Commits

• 185e1c7 Publish cssnano 8.0.2
• 2ce8c2d chore: update the postcs peer dependency
• 99bd9c1 docs: update website dependencies
• 2ca8d4a chore: update development deps
• b245a0b fix: update caniuse-api
• 3bf3f4d chore: update postcss-selector-parser
• 7343c87 fix: preserve apostrophes in svg data uris (#1819)
• 964b9db chore(util): add benchmark + cpuprofile tooling (#1812)
• 54a8db2 Include postcss-discard-overridden types in package
• e0e39ae perf(postcss-merge-longhand): skip processors with no relevant decls
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cssnano since your current version.

Updates postcss-cli from 7.1.1 to 11.0.1

Release notes

Sourced from postcss-cli's releases.

8.0.0 / 2020-09-21

• BREAKING: Support postcss v8 (#344, #349)
• BREAKING: postcss is now a peerDependency, you must install it seperately (#344, #349)
• Upgrade dependencies (#340)

Changelog

Sourced from postcss-cli's changelog.

11.0.1 / 2025-03-12

• Update and minimize dependencies

11.0.0 / 2023-12-05

• BREAKING: Require Node.js v18+ (#464)
• Upgrade to postcss-load-config@5 for improved ESM & TS config support (#461, #462)

10.1.0 / 2022-11-29

• Allow running --watch mode in non-TTY contexts, like Docker (#448)
• Update dependencies

10.0.0 / 2022-06-29

• BREAKING: Drop Node 12 support (#438)
• Add support for ESM config files (#437)

9.1.0 / 2021-12-10

• Don't write to files if they're unchanged (#320, #417)

9.0.2 / 2021-11-04

• Switch to picocolors (#409)
• Remove test files from npm package

9.0.1 / 2021-09-28

• Actually exit with error when attempting to stdout in watch mode
• Remove bin/ from files in package.json

9.0.0 / 2021-09-24

• BREAKING: Require Node.js v12+
• BREAKING: Must specify full file path, including .js extension, when loading local plugins with --use (#401)
• BREAKING: Officially remove support for watching postcss config (was already broken in previous releases)
• Add support for dir-dependency messages (#383, #391)
• Update deps

8.3.1 / 2020-12-12

• Ensure paths are not interpreted as numbers (#360)
• Better errors for incorrect postcss version (#361, #362)

8.3.0 / 2020-11-17

• Exit on EOF/^D (#358)

... (truncated)

Commits

• 7bea180 11.0.1
• 0dc4eba Use eslint v9 + flat config (#490)
• 733ef42 chore(deps): update dependency sugarss to v5 (#483)
• 1363a65 Update dependency prettier to ~3.5.0 (#488)
• bd416f5 Update dependency uuid to v11 (#482)
• bfad16d Update dependency c8 to v10 (#480)
• b5d8f0e feat: replace globby with tinyglobby and remove get-stdin in favor of builtin...
• 5f9f92a Update dependency prettier to ~3.4.0 (#484)
• 0f52be7 Update dependency prettier to ~3.3.0 (#477)
• 528af4c Adding link to PostCSS (#472)
• Additional commits viewable in compare view

Updates postcss-import from 12.0.1 to 16.1.1

Release notes

Sourced from postcss-import's releases.

14.0.0 / 2020-12-14

This release should not have breaking changes for the vast majority of users; only those with @charset statements in their CSS may be affected.

• BREAKING: Error if multiple incompatible @charset statements (#447)
• BREAKING: Warn if @charset statements are not at the top of files (#447)
• Fix handing of @charset (#436, #447)

13.0.0 / 2020-10-20

• BREAKING: Require Node 10+ (#429)
• BREAKING: Upgrade to postcss v8 and require it as a peerDependency (#427, #432)
• Update dependencies

Changelog

Sourced from postcss-import's changelog.

16.1.1 / 2025-06-17

• Fix incorrect cascade layer order when some resources can not be inlined (#567, #574)

16.1.0 / 2024-03-20

• Allow bundling URLs with fragments (useful for Vite users) (#560, #561)

16.0.1 / 2024-02-14

• Fix crash when handling some @imports with media conditions (#557, #558)

16.0.0 / 2024-01-02

• BREAKING: Require Node.js v18+ (#550, #551)
• BREAKING: Signifigant rewrite, with small behavioral tweaks in a number of edge cases
• Support for @supports conditional imports added (#532, #548)
• When skipDuplicates is false, handles import cycles correctly (#462, #535)
• Add warnOnEmpty option to allow disabling warnings for empty files (#84, #541)
• Use proper node.errors (#518, #540)

Huge thanks to @romainmenke for all the hard work he put into this release.

15.1.0 / 2022-12-07

• Add data: URL support (this is not useful for most consumers) (#515)

15.0.1 / 2022-12-01

• Preserve layer in ignored @imports (#510, #511)
• Join media queries in the correct order (#512, #513)

15.0.0 / 2022-08-30

• BREAKING: Require Node.js v14+ (#497)
• BREAKING: Require nameLayer option for handling anonymous layers (#496)
• Fix handling of @media queries inside layered imports (#495, #496)

14.1.0 / 2022-03-22

• Add @layer support (#483)

14.0.2 / 2021-05-10

• Remove remaining direct import of postcss package (#455, #456)

14.0.1 / 2021-03-31

• Fix bug with @charset statements in media imports (#448, #453)

... (truncated)

Commits

• 4ae9894 16.1.1
• a3f3889 Test on modern Node versions (#577)
• 10325fc Upgrade eslint & config; use flat config (#576)
• 9227642 Migrate config renovate.json (#575)
• 2544155 Update dependency prettier to ~3.5.0 (#572)
• 83108aa Fix incorrect cascade layer order when some resources can not be inlined (#574)
• cad0022 Update dependency sugarss to v5 (#568)
• 32deb08 Update dependency c8 to v10 (#565)
• d43ca15 Update dependency prettier to ~3.4.0 (#569)
• 9af465e Update dependency prettier to ~3.3.0 (#564)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by romainmenke, a new releaser for postcss-import since your current version.

Updates postcss-normalize from 9.0.0 to 13.0.1

Release notes

Sourced from postcss-normalize's releases.

10.0.0

• Updated PostCSS support to ^8 (major).
• Updated Node support to 12+ (major).

Changelog

Sourced from postcss-normalize's changelog.

13.0.1

• Maintenance release after updating dependencies

13.0.0

• Pin versions of @csstools/normalize.css and sanitize.css

12.0.0

• Remove TypeScript types. This package is a dual published cjs and esm and it isn't worth it, all info is in README.md.
• Set minimum node version to 18
• Fix resolution of @csstools/normalize.css path when using ESM

11.0.0

• Cleanup build dependencies

10.0.1 (September 15, 2021)

• Added: sanitize.css to support 13+ (major).

This version removes support for pages.css yet is released as a patch version to resolve issues in Create React App. This is a betrayal of semantic versioning.

10.0.0 (April 28, 2021)

• Updated: PostCSS support to ^8 (major).
• Updated: Node support to 12+ (major).

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by romainmenke, a new releaser for postcss-normalize since your current version.

Updates postcss-preset-env from 6.7.0 to 11.3.2

Changelog

Sourced from postcss-preset-env's changelog.

11.3.2

June 28, 2026

• Updated @csstools/css-color-parser to 4.1.9 (patch)
• Updated @csstools/postcss-progressive-custom-properties to 5.1.1 (patch)

11.3.1

June 14, 2026

• Updated @csstools/css-color-parser to 4.1.7 (patch)

11.3.0

May 13, 2026

• Added @csstools/postcss-container-rule-prelude-list Check the plugin README for usage details.
• Added @csstools/postcss-image-function Check the plugin README for usage details.
• Updated cssdb to 8.9.0

11.2.1

April 12, 2026

• Updated @csstools/css-color-parser to 4.1.0 (minor)
• Updated @csstools/css-calc to 3.2.0 (minor)

11.2.0

February 21, 2026

• Added @csstools/postcss-font-width-property Check the plugin README for usage details.
• Updated cssdb to 8.8.0

11.1.3

February 6, 2026

• Updated @csstools/postcss-text-decoration-shorthand to 5.0.2 (patch)

11.1.2

January 25, 2026

• Updated @csstools/postcss-normalize-display-values to 5.0.1 (patch)
• Updated @csstools/color-helpers to 6.0.1 (patch)

11.1.1

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by romainmenke, a new releaser for postcss-preset-env since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[ceph-jenkins]

Thank you for your contribution. Since you, the author, are not a member of the Ceph GitHub Org yet, our CI will not automatically run. Any member of the Ceph Org may comment "ok - to - test" (without the dashes) to allow the Jenkins jobs to run.

[bluikko]

jenkins test

[ceph-jenkins]

Site built/updated successfully! https://1148.ceph.io