Bump postcss, cssnano, postcss-modules, postcss-nested, postcss-simple-vars and postcss-url by dependabot[bot] · Pull Request #1476 · GoogleChromeLabs/squoosh

dependabot · 2026-06-10T21:26:09Z

Bumps postcss, cssnano, postcss-modules, postcss-nested, postcss-simple-vars and postcss-url. These dependencies needed to be updated together.
Updates postcss from 7.0.35 to 8.5.15

Release notes

Sourced from postcss's releases.

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

... (truncated)

Commits

eae46db Release 8.5.15 version
79508ff Update CI actions
b128e21 Speed up declaration parsing by avoiding creating new array on each token
9825dca Fix code format
55789c8 Update dependencies
84fbbe9 Install older pnpm action for old Node.js
9f860bd Revert pnpm action for old Node.js
0877198 Update CI actions
b2d1a33 Fix linter warnings
0700dac Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
Additional commits viewable in compare view

Updates cssnano from 4.1.10 to 8.0.1

Release notes

Sourced from cssnano's releases.

v8.0.1

What's Changed

fix(postcss-minify-selectors): reject :is() fold when divergent middle contains a combinator under a non-empty prefix (closes #1786) by @dkryaklin in cssnano/cssnano#1798

fix(postcss-minify-selectors): tighten :is() fold acceptance to a strict allowlist by @dkryaklin in cssnano/cssnano#1799

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.0...cssnano@8.0.1

v8.0.0

What's Changed

Move declaration sorter to advanced preset by @ludofischer and @Goodwine in cssnano/cssnano#1793

Drop node 20 by @ludofischer in cssnano/cssnano#1794

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.9...cssnano@8.0.0

v7.1.9

Bug Fixes

Reject :is() fold for unknown pseudo-classes with arguments by @dkryaklin in cssnano/cssnano#1791

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.8...cssnano@7.1.9

v7.1.8

What's Changed

fix(postcss-minify-selectors): reject :is() fold for :nth-child(... of S) to preserve cascade by @dkryaklin in cssnano/cssnano#1785

Update postcss and @colordx/core by @ludofischer in cssnano/cssnano#1786

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.7...cssnano@7.1.8

v.7.1.7

This release is idnetical to the previous one, but is being published to ensure that the latest versions of postcss-normalize-repeat-style and postcss-normalize-positions are uploaded to the npm registry.

v7.1.6

New feature

feat(postcss-minify-selectors): fold selector lists into :is() (#1703) by @dkryaklin in cssnano/cssnano#1775

Bug fixes

fix: update colordx and autoprefixer

fix: update postcss peer dependency by @ludofischer in cssnano/cssnano#1779 Solves possible security issue

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.5...cssnano@7.1.6

... (truncated)

Commits

6679a29 Publish cssnano 8.0.1 (#1800)
9a68323 fix(postcss-minify-selectors): tighten :is() fold acceptance to a strict allo...
39a540e fix(postcss-minify-selectors): reject :is() fold when divergent middle contai...
10d54a1 docs: update website for release
1e058fc Publish cssnano 8.0
aa11a12 chore: update PostCSS
ea8e33a chore!: drop Node.js 20 support
c7e9b2f chore: update pnpm to 10.33.3
d7c57da Move declaration sorter to advanced preset (#1793)
2069407 Publish cssnano 7.1.9
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cssnano since your current version.

Updates postcss-modules from 3.2.2 to 6.0.1

Changelog

Sourced from postcss-modules's changelog.

6.0.1

Updated dependencies by Bill Collins (@mrginglymus)

6.0.0

Breaking

The resolve option has two parameters now and can return null. Thanks to Rene Haas (@KingSora) madyankin/postcss-modules@86d8135

Parameters:

file — a module we want to resolve

importer — the file that imports the module we want to resolve

Return value: string | null | Promise<string | null>
postcss([
	require("postcss-modules")({
    	resolve: function (file, importer) {
			return path.resolve(
				path.dirname(importer),
				file.replace(/^@/, process.cwd()
			);
    	},
  	}),
]);
Fixed

#140 "'Failed to obtain root' error on Windows" fixed by Pierre LeMoine (@DrInfiniteExplorer) madyankin/postcss-modules#144

Improved

icss-replace-symbols replaced with with icss-utils by Jason Quense (@jquense). The updated replacer works better and will replace values in selectors, which didn't work until now. madyankin/postcss-modules#145

5.0.0

Fixed composes on Windows by @sapphi-red madyankin/postcss-modules#135

Updated Babel to v7 by @sapphi-red. Minimal supported version of Node.js is 10 from now madyankin/postcss-modules#134

4.3.1

Fixed errors when using shorthand selectors by Felix Bruns (@fxb) madyankin/postcss-modules#130

4.3.0

... (truncated)

Commits

bfd4060 6.0.1
aea9fda Update changelog
a19e40a Update dependencies
bd64c71 Revert "Delete FUNDING.yml"
325f0b3 6.0.0
a453783 Extract pluginFactory and localConvention into separate modules
e87c4ab Refactor to prepare the plugin to work in browsers
1ad9a28 Flatten file hierarchy
d0c05d8 Format changelog
09e0789 Increase line length to 100
Additional commits viewable in compare view

Updates postcss-nested from 4.2.3 to 7.0.2

Release notes

Sourced from postcss-nested's releases.

7.0.2

Fixed nested selector regression (by @Ulyanov-programmer).

7.0.1

Fixed RegExp issue with nested comments (by @Ulyanov-programmer).

7.0.0

More complex logic of when to move comments (by @Ulyanov-programmer).

Removed Node.js 16, 14, and 12 support.

6.2.0

Added @starting-style to bubbling at-rules.

Changelog

Sourced from postcss-nested's changelog.

7.0.2

Fixed nested selector regression (by @Ulyanov-programmer).

7.0.1

Fixed RegExp issue with nested comments (by @Ulyanov-programmer).

7.0.0

More complex logic of when to move comments (by @Ulyanov-programmer).

Removed Node.js 16, 14, and 12 support.

6.2.0

Added @starting-style to bubbling at-rules.

6.1.0

Added @container to bubbling at-rules.

6.0

Added @layer to bubbling at-rules (by Már Örlygsson).

Added moving all preceding comments with rule (by Már Örlygsson).

Added with & without parameters on @at-root (by Már Örlygsson).

Added rootRuleName option (by Már Örlygsson).

Fixed handling sibling @at-root rule blocks (by Már Örlygsson).

5.0.6

Fixed custom at-rules nesting (by @bsak-shell).

5.0.5

Fixed , at the tail (by Jesse de Boer).

5.0.4

Fixed nested & at the tail (by Raphael Luba).

Fixed docs (by Samuel Charpentier).

5.0.3

Fixed compatibility with Autoprefixer by adding @-webkit-keyframes support.

5.0.2

Fixed compatibility with postcss-mixins by moving to visitor API.

5.0.1

Fixed PostCSS 8.1 compatibility.

Added funding links.

5.0

Moved to PostCSS 8.

Moved postcss to peerDependencies.

Commits

db9c614 Release 7.0.2 version
64ff5c5 Fixed an incorrect nesting error (#167)
9f75b38 Release 7.0.1 version
60759a2 Update dependencies
12fc98c Fixed a bug that could cause regexp to issue an error (#165)
3a73b52 Release 7.0.0 version
7451546 Update dependencies
4ac2a59 Fix linter warning
a9a91e7 Correction of the work with comments and general improvements (#163)
013abd3 Remove old Node.js 12, 14, 16
Additional commits viewable in compare view

Updates postcss-simple-vars from 5.0.2 to 7.0.1

Changelog

Sourced from postcss-simple-vars's changelog.

7.0.1

Fixed types (by @Kaciras).

7.0

Added escape sequences support (by @FelixZY).

Removed Node.js 12 support.

Removed Node.js 10 support.

6.0.3

Fixed compatibility with @define-mixin (by Sam Pullman).

6.0.2

Fixed compatibility with postcss-mixins.

6.0.1

Fixed PostCSS 8.1 compatability.

Added funding links.

6.0

Moved to PostCSS 8.

Moved postcss to peerDependencies.

Commits

f9b9661 Release 7.0.1 version
e71464f Update dependencies
ea9b351 Add Node.js 19 to CI
4e51a4b make parameter & variables property optional. (#120)
1126e31 Release 7.0 version
505b5ff Clean up code
9c6e25e Update dev practices
65ca9ec 117: Support backslash sequences and unicode transformation (#118)
aaa29b9 Bump jsdom from 16.4.0 to 16.7.0 (#116)
4fce22b Bump semver-regex from 3.1.3 to 3.1.4 (#115)
Additional commits viewable in compare view

Updates postcss-url from 8.0.0 to 10.1.4

Release notes

Sourced from postcss-url's releases.

10.1.4

Fixed: update minimatch dependency to address CVEs https://nvd.nist.gov/vuln/detail/CVE-2026-27903 https://nvd.nist.gov/vuln/detail/CVE-2026-27904 https://nvd.nist.gov/vuln/detail/CVE-2026-26996 by @diegocr

10.1.3

Fixed: update mime version

10.1.2

Fixed: tilde operator for dependencies to allow for newer patch version

10.1.1

Fixed: updated mime and xxhashjs versions Fixed: postcss peerDependency version 8.1.2 -> 8.0.0

10.1.0

Fixed: Replaced mkdirp with make-dir (PR#152) Fixed: updated dev dependencies, resolved npm audit issues Fixed: unlock postcss in peerDependecies

10.0.0

Added: support for PostCSS 8 (PR#148) Fixed: path resolution when to/from paths match (PR#136)

9.0.0 - beta - 2019-04-17

Added: async api (PR#134)

Changelog

Sourced from postcss-url's changelog.

10.1.4 - 2026-05-21

Fixed: update minimatch dependency to address CVEs https://nvd.nist.gov/vuln/detail/CVE-2026-27903 https://nvd.nist.gov/vuln/detail/CVE-2026-27904 https://nvd.nist.gov/vuln/detail/CVE-2026-26996 by @diegocr

10.1.3 - 2021-03-19

Fixed: update mime version

10.1.2 - 2021-03-19

Fixed: tilde operator for dependencies to allow for newer patch version

10.1.1 - 2020-11-26

Fixed: updated mime and xxhashjs versions Fixed: postcss peerDependency version 8.1.2 -> 8.0.0

10.1.0 - 2020-11-04

Fixed: Replaced mkdirp with make-dir (PR#152) Fixed: updated dev dependencies, resolved npm audit issues

10.0.0 - 2020-10-23

Added: support for PostCSS 8 (PR#148) Fixed: path resolution when to/from paths match (PR#136)

9.0.0 - 2019-04-17

Fixed: Async API Added: support for PostCSS 8

Commits

4a729fb 10.1.4
98c9de0 Update dev deps & package-lock.json
ff8a5b6 Bump minimatch to sort CVEs (#185)
c2523fb chore: update changelog
fc52c88 10.1.3
6c061a2 fix: sync package-lock
87db4b7 Merge pull request #158 from realityking/mime
fdff9b1 Upgrade mime to 2.5 again
a843ca0 Correctly configure save-prefix
301e572 chore: update changelog
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

…e-vars and postcss-url Bumps [postcss](https://github.com/postcss/postcss), [cssnano](https://github.com/cssnano/cssnano), [postcss-modules](https://github.com/css-modules/postcss-modules), [postcss-nested](https://github.com/postcss/postcss-nested), [postcss-simple-vars](https://github.com/postcss/postcss-simple-vars) and [postcss-url](https://github.com/postcss/postcss-url). These dependencies needed to be updated together. Updates `postcss` from 7.0.35 to 8.5.15 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@7.0.35...8.5.15) Updates `cssnano` from 4.1.10 to 8.0.1 - [Release notes](https://github.com/cssnano/cssnano/releases) - [Commits](https://github.com/cssnano/cssnano/compare/v4.1.10...cssnano@8.0.1) Updates `postcss-modules` from 3.2.2 to 6.0.1 - [Changelog](https://github.com/madyankin/postcss-modules/blob/master/CHANGELOG.md) - [Commits](madyankin/postcss-modules@v3.2.2...v6.0.1) Updates `postcss-nested` from 4.2.3 to 7.0.2 - [Release notes](https://github.com/postcss/postcss-nested/releases) - [Changelog](https://github.com/postcss/postcss-nested/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-nested@4.2.3...7.0.2) Updates `postcss-simple-vars` from 5.0.2 to 7.0.1 - [Changelog](https://github.com/postcss/postcss-simple-vars/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-simple-vars@5.0.2...7.0.1) Updates `postcss-url` from 8.0.0 to 10.1.4 - [Release notes](https://github.com/postcss/postcss-url/releases) - [Changelog](https://github.com/postcss/postcss-url/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-url@8.0.0...10.1.4) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.15 dependency-type: direct:development - dependency-name: cssnano dependency-version: 8.0.1 dependency-type: direct:development - dependency-name: postcss-modules dependency-version: 6.0.1 dependency-type: direct:development - dependency-name: postcss-nested dependency-version: 7.0.2 dependency-type: direct:development - dependency-name: postcss-simple-vars dependency-version: 7.0.1 dependency-type: direct:development - dependency-name: postcss-url dependency-version: 10.1.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 10, 2026

dependabot Bot mentioned this pull request Jun 10, 2026

Bump postcss from 7.0.35 to 8.4.31 #1383

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump postcss, cssnano, postcss-modules, postcss-nested, postcss-simple-vars and postcss-url#1476

Bump postcss, cssnano, postcss-modules, postcss-nested, postcss-simple-vars and postcss-url#1476
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/multi-772367cc60

dependabot Bot commented on behalf of github Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 10, 2026

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.3

8.5.2

8.5.1

8.5 “Duke Alloces”

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.3

v8.0.1

What's Changed

v8.0.0

What's Changed

v7.1.9

Bug Fixes

v7.1.8

What's Changed

v.7.1.7

v7.1.6

New feature

Bug fixes

6.0.1

6.0.0

Breaking

Fixed

Improved

5.0.0

4.3.1

4.3.0

7.0.2

7.0.1

7.0.0

6.2.0

7.0.2

7.0.1

7.0.0

6.2.0

6.1.0

6.0

5.0.6

5.0.5

5.0.4

5.0.3

5.0.2

5.0.1

5.0

7.0.1

7.0

6.0.3

6.0.2

6.0.1

6.0

10.1.4

10.1.3

10.1.2

10.1.1

10.1.0