Skip to content

Bump postcss, @fullhuman/postcss-purgecss, cssnano, postcss-cli, postcss-import, postcss-normalize and postcss-preset-env - #1181

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-e589dd66dd
Open

Bump postcss, @fullhuman/postcss-purgecss, cssnano, postcss-cli, postcss-import, postcss-normalize and postcss-preset-env#1181
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-e589dd66dd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown

Bumps postcss to 8.5.26 and updates ancestor dependencies postcss, @fullhuman/postcss-purgecss, cssnano, postcss-cli, postcss-import, postcss-normalize and postcss-preset-env. These dependencies need to be updated together.

Updates postcss from 7.0.36 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates @fullhuman/postcss-purgecss from 3.0.0 to 3.1.3

Release notes

Sourced from @​fullhuman/postcss-purgecss's releases.

v3.1.3

Changes

  • postcss-purgecss remove postcss 8 as peer dependency
  • purgecss-webpack-plugin fix backward compatibility with webpack 4
  • PurgeCSS Update to PostCSS 8
  • postcss-purgecss Add compatibility with PostCSS 8
  • purgecss-webpack-plugin Fix deprecation warning with Webpack 5

Bug Fixes

Changelog

Sourced from @​fullhuman/postcss-purgecss's changelog.

8.0.0

BREAKING CHANGES

  • Revert the changes from v7.0.2 that modified the import of the PostCSS plugin. This was causing issues (see #1295. The PostCSS plugin should now be imported via a default import:
import purgeCSSPlugin from '@fullhuman/postcss-purgecss';

Features

  • feat: add --preserve-paths option to CLI for maintaining folder hierarchy (aa5ac9d), closes #377

Bug fixes

  • fix: for code scanning alert no. 5: Incomplete multi-character sanitization (#1403) (3f39411), closes #1403
  • fix: enhance setOptions to support both ES modules and CommonJS config exports (4ad48c4), closes #1340
  • fix: fix glob expression illegal operations on directories (#1308) (b27293f), closes #1308 #1266
  • fix: update import statements for purgeCSSPlugin in documentation and source files (e5cbce2), closes #1295
  • fix(#995): preserve relative paths in source maps (4f6c4d9), closes #995
  • fix: enhance keyframes handling to preserve animations referenced via CSS variables (076c027), closes #478

Changes (commits since v7.0.2)

  • Add French documentation for PurgeCSS guides and plugins (b9f4309)
  • fix for "Workflow does not contain permissions" (eb6d3b8)
  • fix(#995): preserve relative paths in source maps (4f6c4d9), closes #995
  • v8.0.0 (2e315a5)
  • chore: format (6c0c84e)
  • chore: format (7ad2fb7)
  • docs: add breaking changes for v7 about named export for postcss plugin (7d86fb5)
  • docs: add changelog for v7 (bafb8a1)
  • docs: add SEO enhancements and sitemap support to documentation (6505b7d)
  • docs: remove outdated TailwindCSS sponsor image (3949790)
  • docs: update sponsorship images and remove outdated link (bdf87e4)
  • docs: use named export for postcss plugin (8eb027d)
  • feat: add --preserve-paths option to CLI for maintaining folder hierarchy (aa5ac9d), closes #377
  • feat: enhance keyframes handling to preserve animations referenced via CSS variables (076c027), closes #478
  • build(deps-dev): bump @​eslint/eslintrc from 3.1.0 to 3.2.0 (#1303) (8308cdb), closes #1303
  • build(deps-dev): bump @​eslint/js from 9.11.1 to 9.39.0 (#1391) (2348f82), closes #1391
  • build(deps-dev): bump @​rollup/plugin-typescript from 12.1.0 to 12.1.2 (#1312) (9387a9b), closes #1312
  • build(deps-dev): bump @​rollup/plugin-typescript from 12.1.2 to 12.3.0 (#1407) (5902189), closes #1407
  • build(deps-dev): bump @​types/glob from 8.0.0 to 9.0.0 (#1408) (aa30f0f), closes #1408
  • build(deps-dev): bump @​types/jest from 29.5.13 to 29.5.14 (#1301) (cb3d1c4), closes #1301
  • build(deps-dev): bump @​types/node from 22.13.0 to 25.0.3 (#1406) (ca242ee), closes #1406
  • build(deps-dev): bump @​types/node from 22.8.6 to 22.13.0 (#1322) (0d9f594), closes #1322
  • build(deps-dev): bump @​typescript-eslint/parser from 8.14.0 to 8.46.2 (#1390) (67b5b0c), closes #1390
  • build(deps-dev): bump @​vuepress/plugin-search (#1320) (00251a7), closes #1320
  • build(deps-dev): bump @​vuepress/plugin-search (#1372) (307f8d2), closes #1372
  • build(deps-dev): bump @​vuepress/theme-default (#1405) (047f0ea), closes #1405

... (truncated)

Commits
  • 6ea98b6 build: 3.1.3
  • 9ff20f3 chore: update changelog
  • 48a8a48 build: 3.1.3 pre
  • ff2eff5 fix(postcss-purgecss): remove postcss as peer dependency
  • 96915f1 chore: update gitignore
  • 5474af6 build(deps): bump commander from 6.2.0 to 6.2.1
  • 6ed31d5 build: 3.1.2
  • 501249c fix: check chunk.files type at runtime
  • 30515c8 build(deps-dev): bump ts-jest from 26.4.2 to 26.4.4
  • 9c83a15 build: 3.1.1
  • Additional commits viewable in compare view

Updates cssnano from 4.1.10 to 8.0.4

Release notes

Sourced from cssnano's releases.

v8.0.4

What's Changed

Bug Fixes

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.3...cssnano@8.0.4

v8.0.3

What's Changed

Bug Fixes

  • postcss-reduce-initial: update initial properties
  • potcss-minify-gradients: handle more than two stops
  • postcss-normalize-whitespace: preserve whitespace in custom prop
  • postcss-normalize-url: ensure trailing slash is preserved

Other Changes

  • packages now define an exports field in package.json. This prevents any file added to the package to automatically be exposed as a possible import. The has been done in a backward compatible way, so you should be able to import every file you did in the previous release.

  • types have also been regenerated with TypeScript 7.

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.2...cssnano@8.0.3

v8.0.2

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.1...cssnano@8.0.2

v8.0.1

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.0...cssnano@8.0.1

v8.0.0

What's Changed

... (truncated)

Commits
  • 6b64af9 chore: update types
  • 6a2ed8b Publish cssnano 8.0.4
  • cb09239 fix(postcss-svgo): use built-in URI encoder
  • e1a7419 fix(postcss-svgo): improve character encoding
  • dceffee chore: update lockfile after creating devEngines field in package.json
  • dca50f7 docs: add devengines field to website package.json
  • c169273 docs: remove unused website dependency
  • bca3dad docs: add browserslist query for building the website
  • 67c666e chore: remove unused package.json field
  • c24a5a4 chore(ci): update devTools packageManger and use pnpm/setup everywhere
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cssnano since your current version.


Updates postcss-cli from 7.1.1 to 11.0.1

Release notes

Sourced from postcss-cli's releases.

8.0.0 / 2020-09-21

  • BREAKING: Support postcss v8 (#344, #349)
  • BREAKING: postcss is now a peerDependency, you must install it seperately (#344, #349)
  • Upgrade dependencies (#340)
Changelog

Sourced from postcss-cli's changelog.

11.0.1 / 2025-03-12

  • Update and minimize dependencies

11.0.0 / 2023-12-05

10.1.0 / 2022-11-29

  • Allow running --watch mode in non-TTY contexts, like Docker (#448)
  • Update dependencies

10.0.0 / 2022-06-29

  • BREAKING: Drop Node 12 support (#438)
  • Add support for ESM config files (#437)

9.1.0 / 2021-12-10

  • Don't write to files if they're unchanged (#320, #417)

9.0.2 / 2021-11-04

  • Switch to picocolors (#409)
  • Remove test files from npm package

9.0.1 / 2021-09-28

  • Actually exit with error when attempting to stdout in watch mode
  • Remove bin/ from files in package.json

9.0.0 / 2021-09-24

  • BREAKING: Require Node.js v12+
  • BREAKING: Must specify full file path, including .js extension, when loading local plugins with --use (#401)
  • BREAKING: Officially remove support for watching postcss config (was already broken in previous releases)
  • Add support for dir-dependency messages (#383, #391)
  • Update deps

8.3.1 / 2020-12-12

  • Ensure paths are not interpreted as numbers (#360)
  • Better errors for incorrect postcss version (#361, #362)

8.3.0 / 2020-11-17

  • Exit on EOF/^D (#358)

... (truncated)

Commits

Updates postcss-import from 12.0.1 to 16.1.1

Release notes

Sourced from postcss-import's releases.

14.0.0 / 2020-12-14

This release should not have breaking changes for the vast majority of users; only those with @charset statements in their CSS may be affected.

  • BREAKING: Error if multiple incompatible @charset statements (#447)
  • BREAKING: Warn if @charset statements are not at the top of files (#447)
  • Fix handing of @charset (#436, #447)

13.0.0 / 2020-10-20

  • BREAKING: Require Node 10+ (#429)
  • BREAKING: Upgrade to postcss v8 and require it as a peerDependency (#427, #432)
  • Update dependencies
Changelog

Sourced from postcss-import's changelog.

16.1.1 / 2025-06-17

  • Fix incorrect cascade layer order when some resources can not be inlined (#567, #574)

16.1.0 / 2024-03-20

  • Allow bundling URLs with fragments (useful for Vite users) (#560, #561)

16.0.1 / 2024-02-14

  • Fix crash when handling some @imports with media conditions (#557, #558)

16.0.0 / 2024-01-02

  • BREAKING: Require Node.js v18+ (#550, #551)
  • BREAKING: Signifigant rewrite, with small behavioral tweaks in a number of edge cases
  • Support for @supports conditional imports added (#532, #548)
  • When skipDuplicates is false, handles import cycles correctly (#462, #535)
  • Add warnOnEmpty option to allow disabling warnings for empty files (#84, #541)
  • Use proper node.errors (#518, #540)

Huge thanks to @romainmenke for all the hard work he put into this release.

15.1.0 / 2022-12-07

  • Add data: URL support (this is not useful for most consumers) (#515)

15.0.1 / 2022-12-01

  • Preserve layer in ignored @imports (#510, #511)
  • Join media queries in the correct order (#512, #513)

15.0.0 / 2022-08-30

  • BREAKING: Require Node.js v14+ (#497)
  • BREAKING: Require nameLayer option for handling anonymous layers (#496)
  • Fix handling of @media queries inside layered imports (#495, #496)

14.1.0 / 2022-03-22

  • Add @layer support (#483)

14.0.2 / 2021-05-10

  • Remove remaining direct import of postcss package (#455, #456)

14.0.1 / 2021-03-31

  • Fix bug with @charset statements in media imports (#448, #453)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by romainmenke, a new releaser for postcss-import since your current version.


Updates postcss-normalize from 9.0.0 to 13.0.1

Release notes

Sourced from postcss-normalize's releases.

10.0.0

  • Updated PostCSS support to ^8 (major).
  • Updated Node support to 12+ (major).
Changelog

Sourced from postcss-normalize's changelog.

13.0.1

  • Maintenance release after updating dependencies

13.0.0

  • Pin versions of @csstools/normalize.css and sanitize.css

12.0.0

  • Remove TypeScript types. This package is a dual published cjs and esm and it isn't worth it, all info is in README.md.
  • Set minimum node version to 18
  • Fix resolution of @csstools/normalize.css path when using ESM

11.0.0

  • Cleanup build dependencies

10.0.1 (September 15, 2021)

  • Added: sanitize.css to support 13+ (major).

This version removes support for pages.css yet is released as a patch version to resolve issues in Create React App. This is a betrayal of semantic versioning.

10.0.0 (April 28, 2021)

  • Updated: PostCSS support to ^8 (major).
  • Updated: Node support to 12+ (major).
Commits
Maintainer changes

This version was pushed to npm by romainmenke, a new releaser for postcss-normalize since your current version.


Updates postcss-preset-env from 6.7.0 to 11.3.2

Changelog

Sourced from postcss-preset-env's changelog.

11.3.2

June 28, 2026

11.3.1

June 14, 2026

11.3.0

May 13, 2026

11.2.1

April 12, 2026

11.2.0

February 21, 2026

11.1.3

February 6, 2026

11.1.2

January 25, 2026

11.1.1

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by romainmenke, a new releaser for postcss-preset-env since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump postcss, @fullhuman/postcss-purgecss, cssnano, postcss-cli, post…
24ec43f 
…css-import, postcss-normalize and postcss-preset-env

Bumps [postcss](https://github.com/postcss/postcss) to 8.5.26 and updates ancestor dependencies [postcss](https://github.com/postcss/postcss), [@fullhuman/postcss-purgecss](https://github.com/FullHuman/purgecss), [cssnano](https://github.com/cssnano/cssnano), [postcss-cli](https://github.com/postcss/postcss-cli), [postcss-import](https://github.com/postcss/postcss-import), [postcss-normalize](https://github.com/csstools/postcss-normalize) and [postcss-preset-env](https://github.com/csstools/postcss-plugins/tree/HEAD/plugin-packs/postcss-preset-env). These dependencies need to be updated together.


Updates `postcss` from 7.0.36 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@7.0.36...8.5.26)

Updates `@fullhuman/postcss-purgecss` from 3.0.0 to 3.1.3
- [Release notes](https://github.com/FullHuman/purgecss/releases)
- [Changelog](https://github.com/FullHuman/purgecss/blob/main/CHANGELOG.md)
- [Commits](FullHuman/purgecss@v3.0.0...v3.1.3)

Updates `cssnano` from 4.1.10 to 8.0.4
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/compare/v4.1.10...cssnano@8.0.4)

Updates `postcss-cli` from 7.1.1 to 11.0.1
- [Release notes](https://github.com/postcss/postcss-cli/releases)
- [Changelog](https://github.com/postcss/postcss-cli/blob/master/CHANGELOG.md)
- [Commits](postcss/postcss-cli@7.1.1...11.0.1)

Updates `postcss-import` from 12.0.1 to 16.1.1
- [Release notes](https://github.com/postcss/postcss-import/releases)
- [Changelog](https://github.com/postcss/postcss-import/blob/master/CHANGELOG.md)
- [Commits](postcss/postcss-import@12.0.1...16.1.1)

Updates `postcss-normalize` from 9.0.0 to 13.0.1
- [Release notes](https://github.com/csstools/postcss-normalize/releases)
- [Changelog](https://github.com/csstools/postcss-normalize/blob/main/CHANGELOG.md)
- [Commits](https://github.com/csstools/postcss-normalize/commits)

Updates `postcss-preset-env` from 6.7.0 to 11.3.2
- [Changelog](https://github.com/csstools/postcss-plugins/blob/main/plugin-packs/postcss-preset-env/CHANGELOG.md)
- [Commits](https://github.com/csstools/postcss-plugins/commits/HEAD/plugin-packs/postcss-preset-env)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: indirect
- dependency-name: "@fullhuman/postcss-purgecss"
  dependency-version: 3.1.3
  dependency-type: direct:development
- dependency-name: cssnano
  dependency-version: 8.0.4
  dependency-type: direct:development
- dependency-name: postcss-cli
  dependency-version: 11.0.1
  dependency-type: direct:development
- dependency-name: postcss-import
  dependency-version: 16.1.1
  dependency-type: direct:development
- dependency-name: postcss-normalize
  dependency-version: 13.0.1
  dependency-type: direct:development
- dependency-name: postcss-preset-env
  dependency-version: 11.3.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 8, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 8, 2026 18:36
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 8, 2026
@dependabot dependabot Bot mentioned this pull request Aug 8, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants