chore(deps): bump postcss from 8.5.6 to 8.5.23

[dependabot]

Bumps postcss from 8.5.6 to 8.5.23.

Release notes

Sourced from postcss's releases.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

... (truncated)

Commits

• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

[pkg-pr-new]

Open in StackBlitz

@faststore/api

npm i https://pkg.pr.new/vtex/faststore/@faststore/api@4e1812d

@faststore/cli

npm i https://pkg.pr.new/vtex/faststore/@faststore/cli@4e1812d

@faststore/components

npm i https://pkg.pr.new/vtex/faststore/@faststore/components@4e1812d

@faststore/core

npm i https://pkg.pr.new/vtex/faststore/@faststore/core@4e1812d

@faststore/diagnostics

npm i https://pkg.pr.new/vtex/faststore/@faststore/diagnostics@4e1812d

@faststore/lighthouse

npm i https://pkg.pr.new/vtex/faststore/@faststore/lighthouse@4e1812d

@faststore/sdk

npm i https://pkg.pr.new/vtex/faststore/@faststore/sdk@4e1812d

@faststore/ui

npm i https://pkg.pr.new/vtex/faststore/@faststore/ui@4e1812d

commit: 4e1812d

[renatomaurovtex]

Reviewed as lockfile-only dependency bump (supersedes #3418, which dependabot auto-closed).

Assessment

Dependency Discipline — postcss is an existing runtime dependency of @faststore/core (^8.4.4); 8.5.23 is an in-range patch resolution with no manifest change, so the new-runtime-dep checklist doesn't apply.

Security — 8.5.23 stops loading a previous source map unless opts.from is set (the source-map-exposure hardening this bump line has been chasing; this release actually carries it). 8.5.19–8.5.22 are stringifier/AST edge fixes (semicolons before comments, AtRule#params spacing) — low risk for how core uses postcss.

Lockfile state — better than #3418 left it: all postcss@8.5.6 entries are gone, leaving two resolutions — 8.5.23 (direct/core contexts, autoprefixer, css-modules chain) and 8.5.25 (floated peer contexts: stylelint, tsup, postcss-loader). No new transitive packages.

💬 The ±10k/−17k churn is once again the prettier ↔ pnpm-native quote reflow, not real change (same as #3416/#3424/#3426). Re-upping the standing suggestion: exclude pnpm-lock.yaml from prettier so these diffs shrink to a few lines.

CI — the red FastStore check is only the "Publish to Chromatic" step (✖ Missing project token — the known dependabot-token pattern, see #3361); turbo tasks are 12/12 successful in that same job, and SonarQube / codesandbox / dkcicd / provenance are all green. Note the workflow still runs chromaui/action@v17, so #3428 (v18 bump) is still pending — unrelated here.

Verdict: Approved

Blocking (🔴/🟠):

• None.

Non-blocking (🟡/💬):

• 💬 Exclude pnpm-lock.yaml from prettier to kill the recurring ±10k reflow churn in dependabot PRs.

Checks to confirm before merge: none beyond current CI — Chromatic red is the known dependabot token pattern (#3361), turbo 12/12 green.

[sonar-workflows]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (36.30% Estimated after merge)
• No data about duplications (1.40% Estimated after merge)

Project ID: vtex_faststore_f0a862d5-9557-49f9-8d09-de40caa76622

View in SonarQube