Skip to content

build(deps-dev): bump postcss from 8.5.8 to 8.5.13#1684

Merged
paulfalgout merged 1 commit intodevelopfrom
dependabot/npm_and_yarn/postcss-8.5.13
May 4, 2026
Merged

build(deps-dev): bump postcss from 8.5.8 to 8.5.13#1684
paulfalgout merged 1 commit intodevelopfrom
dependabot/npm_and_yarn/postcss-8.5.13

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 4, 2026

Bumps postcss from 8.5.8 to 8.5.13.

Release notes

Sourced from postcss's releases.

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.
Changelog

Sourced from postcss's changelog.

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Upgrade dev dependency postcss from 8.5.8 to 8.5.13 to bring in security and parser fixes for our CSS build. This includes XSS and unsafe file-read patches, an SCSS comment regression fix, and parsing performance improvements; no app code changes.

Written for commit 36953e9. Summary will update on new commits.

Bumps [postcss](https://github.com/postcss/postcss) from 8.5.8 to 8.5.13.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.8...8.5.13)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.13
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 4, 2026
Copy link
Copy Markdown

@devin-ai-integration devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Open in Devin Review

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 2 files

@cypress
Copy link
Copy Markdown

cypress Bot commented May 4, 2026

RoundingWell Care Ops Frontend    Run #8904

Run Properties:  status check passed Passed #8904  •  git commit 36953e98f9: build(deps-dev): bump postcss from 8.5.8 to 8.5.13
Project RoundingWell Care Ops Frontend
Branch Review dependabot/npm_and_yarn/postcss-8.5.13
Run status status check passed Passed #8904
Run duration 02m 32s
Commit git commit 36953e98f9: build(deps-dev): bump postcss from 8.5.8 to 8.5.13
Committer dependabot[bot]
View all properties for this run ↗︎

Test results
Tests that failed  Failures 0
Tests that were flaky  Flaky 2
Tests that did not run due to a developer annotating a test with .skip  Pending 0
Tests that did not run due to a failure in a mocha hook  Skipped 0
Tests that passed  Passing 236
View all changes introduced in this branch ↗︎

@coveralls
Copy link
Copy Markdown

Coverage Report for CI Build 0

Coverage increased (+1.9%) to 100.0%

Details

  • Coverage increased (+1.9%) from the base build.
  • Patch coverage: No coverable lines changed in this PR.
  • No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.


Coverage Stats

Coverage Status
Relevant Lines: 6054
Covered Lines: 6054
Line Coverage: 100.0%
Relevant Branches: 1844
Covered Branches: 1844
Branch Coverage: 100.0%
Branches in Coverage %: Yes
Coverage Strength: 271.31 hits per line

💛 - Coveralls

@paulfalgout paulfalgout merged commit 1a3a3d3 into develop May 4, 2026
6 checks passed
@paulfalgout paulfalgout deleted the dependabot/npm_and_yarn/postcss-8.5.13 branch May 4, 2026 12:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants