Skip to content

chore(deps): update dependency postcss to v7#177

Open
dev-mend-for-github-com[bot] wants to merge 1 commit intoelectron-upgradefrom
whitesource-remediate/postcss-7.x
Open

chore(deps): update dependency postcss to v7#177
dev-mend-for-github-com[bot] wants to merge 1 commit intoelectron-upgradefrom
whitesource-remediate/postcss-7.x

Conversation

@dev-mend-for-github-com
Copy link

@dev-mend-for-github-com dev-mend-for-github-com bot commented Nov 10, 2025

This PR contains the following updates:

Package Type Update Change
postcss (source) dependencies major 5.2.47.0.36

By merging this PR, the issue #6 will be automatically resolved and closed:

Severity CVSS Score Vulnerability Reachability
Medium Medium 5.3 CVE-2021-23382

Release Notes

postcss/postcss (postcss)

v7.0.36

Compare Source

  • Backport ReDoS vulnerabilities from PostCSS 8.

v7.0.35

Compare Source

  • Add migration guide link to PostCSS 8 error text.

v7.0.34

Compare Source

  • Fix compatibility with postcss-scss 2.

v7.0.33

Compare Source

  • Add error message for PostCSS 8 plugins.

v7.0.32

Compare Source

v7.0.31

Compare Source

  • Use only the latest source map annotation (by Emmanouil Zoumpoulakis).

v7.0.30

Compare Source

  • Fix TypeScript definition (by Natalie Weizenbaum).

v7.0.29

Compare Source

  • Update Processor#version.

v7.0.28

Compare Source

  • Fix TypeScript definition (by Natalie Weizenbaum).

v7.0.27

Compare Source

  • Fix TypeScript definition (by Natalie Weizenbaum).

v7.0.26

Compare Source

  • Fix TypeScript definition (by Natalie Weizenbaum).

v7.0.25

Compare Source

  • Fix absolute path support for Windows (by Tom Raviv).

v7.0.24

Compare Source

  • Fix TypeScript definition (by Keith Cirkel).

v7.0.23

Compare Source

  • Update Processor#version.

v7.0.22

Compare Source

  • Add funding link for npm fund.

v7.0.21

Compare Source

  • Revert passing nodes property to node constructor.

v7.0.20

Compare Source

  • Allow to pass PostCSS’s nodes in nodes property to node constructor.

v7.0.19

Compare Source

  • Fix passing nodes property to node constructor.

v7.0.18

Compare Source

  • Fix TypeScript type definitions (by Jan Buschtöns).

v7.0.17

Compare Source

  • Fix TypeScript type definitions (by Bob Matcuk and Jan Buschtöns).

v7.0.16

Compare Source

  • Revert Custom Properties fix until PostCSS 8.0.

v7.0.15

Compare Source

  • Fix Custom Properties support (by Ivan Solovev).

v7.0.14

Compare Source

  • Fix tokenizer for postcss-less (by Matt Lyons).

v7.0.13

Compare Source

  • Fix parsing regression in 7.0.12 for comments between property and value.

v7.0.12

Compare Source

  • Fix parsing broken CSS with two words in declaration property.

v7.0.11

Compare Source

  • Fix source maps on declaration semicolon (by Niklas Mischkulnig).

v7.0.10

Compare Source

  • Fix source maps (by Niklas Mischkulnig).

v7.0.9

Compare Source

  • Increase stringifing performance for non-raws AST.

v7.0.8

Compare Source

  • Fix TypeScript definitions (by Ankur Oberoi).
  • Use support-colors 6.0.

v7.0.7

Compare Source

  • Extend Error in CssSyntaxError.

v7.0.6

Compare Source

  • Fix parsing files with BOM (by Veniamin Krol).

v7.0.5

Compare Source

  • Reduce npm package size (by Gilad Peleg).

v7.0.4

Compare Source

  • Fix safe parser regression.

v7.0.3

Compare Source

  • Update Processor#version.

v7.0.2

Compare Source

  • Update Processor#version.

v7.0.1

Compare Source

  • Fix passing nodes property to node constructor.

v7.0.0: 7.0 “President Amy”

Compare Source

President Amy seal

PostCSS 7.0 dropped Node.js 4 support and brought small features.

Breaking Changes

We removed Node.js 4 and Node.js 9 support since it doesn’t have security updates anymore.

We removed IE and “dead” browsers (without security updates) from Babel’s Browserslist. Don't worry, PostCSS still generate IE-compatible code. These changes affect websites which run PostCSS on client-side like CodePen.

last 2 version
not dead
not Explorer 11
not ExplorerMobile 11
node 10
node 8
node 6

New Features

@​nikhilgaba added cute thing for plugin developers. If an error was happened in Container#walk() circle, PostCSS will show in stack trace CSS node, which causes this error:

TypeError: Cannot read property '0' of undefined
    at /home/ai/Dev/test/app.css:10:4
    at plugin (plugin.js:2:4)
    at runPostCSS (runner.js:2:1)

@​igorkamyshev added finally method to LazyResult to make it compatible with the latest Promise API.

Other Changes

  • Client-side size was reduced by Size Limit feedback.
  • Add warning on calling PostCSS without plugins and syntax options.

v6.0.23

Compare Source

  • Fix parsing nested at-rules without semicolon, params, and spaces.
  • Fix docs (by Kevin Schiffer and Pat Cavit).

v6.0.22

Compare Source

  • Fix Node#prev and Node#next on missed parent.

v6.0.21

Compare Source

  • Rename Chinese docs to fix yarnpkg.com issue.

v6.0.20

Compare Source

  • Better error message on null as input CSS.

v6.0.19

Compare Source

  • Fix TypeScript definitions for source maps (by Oleh Kuchuk).
  • Fix source field in TypeScript definitions (by Sylvain Pollet-Villard).

v6.0.18

Compare Source

  • Use primitive object in TypeScript definitions (by Sylvain Pollet-Villard).

v6.0.17

Compare Source

  • Fix parsing comment in selector between word tokens (by Oleh Kuchuk).

v6.0.16

Compare Source

  • Fix warning text (by Michael Keller).

v6.0.15

Compare Source

  • Add warning about missed from option on process().then() call.
  • Add IE 10 support.

v6.0.14

Compare Source

  • Fix TypeScript definitions (by Jed Mao).

v6.0.13

Compare Source

  • Fix TypeScript definitions for case of multiple PostCSS versions
    in node_modules (by Chris Eppstein).
  • Use source-map 0.6.

v6.0.12

Compare Source

  • Don’t copy * hack to declaration indent.

v6.0.11

Compare Source

  • Add upper case !IMPORTANT support.

v6.0.10

Compare Source

  • Reduce PostCSS size in webpack bundle.

v6.0.9

Compare Source

  • Improve error message for plugin with old PostCSS (by Igor Adamenko).

v6.0.8

Compare Source

  • Fix Node.js 4.2.2 support.

v6.0.7

Compare Source

  • Fix base64 decoding for old Node.js and browser.

v6.0.6

Compare Source

  • Fix end position in at-rule without semicolon (by Oleh Kuchuk).

v6.0.5

Compare Source

  • Move Babel config from package.json for node_modules compiling cases.

v6.0.4

Compare Source

  • Fix parsing ;; after rules.
  • Use Chalk 2.0.

v6.0.3

Compare Source

  • Fix escape sequences parsing (by Oleh Kuchuk).
  • Added ability to force disable colors with an environment variable.
  • Improved color detection of some terminal apps.

v6.0.2

Compare Source

  • Fix parsing nested at-rules without semicolon, params, and spaces.
  • Fix docs (by Kevin Schiffer and Pat Cavit).

v6.0.1

Compare Source

  • Fix TypeScript definitions for source maps (by Oleh Kuchuk).
  • Fix source field in TypeScript definitions (by Sylvain Pollet-Villard).

v6.0.0: 6.0 “Marquis Orias”

Marquis Orias seal

PostCSS 6.0 drops support for Node.js 0.12, cleans the raws API, adds support for @apply, and uses less memory.

Breaking Changes

Node.js stopped 0.12 support in January 01. So PostCSS dropped Node.js 0.12 from all tests. Please update your Node.js version to 4.0 or 7.0.

In 6.0 we fixed our mistakes in API design. First, if node already had a parent, insert methods (append, insertAfter, etc) will not clone it anymore. In 6.0 inserts methods will remove inserted node from previous parent:

parent1.nodes.length //=> 3
parent2.append(parent1.nodes[0])
parent1.nodes.length //=> 2

Now, moveTo, moveAfter & moveBefore are deprecated because regular insert methods have this move behavior.

Also Node#clone now returns the exact copy of a node. In 6.0 it no longer cleans raws.

node.raws.before //=> "\n  "
const clone = node.clone()
clone.raws.before //=> "\n  "

Every PostCSS plugin has plugin.process shortcut. In 6.0 we split process and plugin options in this shortcut:

const plugin = postcss.plugin('postcss-awesome', colors => {
  
})
plugin.process(css, { from: 'app.css' }, colors).css

In the new major release, we finally remove all deprecated methods from PostCSS 4.0. It should not be a big problem because we show deprecated warnings for them for 2 years. Most of the plugins updated their API.

New Methods and Properties

Since we removed deprecated methods from PostCSS 4.0, in 6.0 we were free to add before() and after() shortcuts, similar to DOM API methods.

node1.before(node2)
// is equal too
node1.parent.insertBefore(node1, node2)

Chrome 51 started to support “native CSS mixins” from @​tabatkins spec under the flag:

:root {
  --clearfix: {
    display: table;
    clear: both;
    content: '';
  };
}

.box:after{
  @​apply --clearfix;
}

PostCSS 5.0 could parse it pretty well, but in some cases, it lost the semicolon after a mixin definition. In PostCSS 6.0 parser we covered this case, and node rules have Rule#raws.ownSemicolon for their own semicolon.

Stream Parser

In PostCSS 5.0 tokenizing and parsing were separated steps. As a result, we wrote all tokens into memory between steps. It worked well most of the time, but had a large memory usage when parsing really big CSS files (more than 25 MB).

In 6.0 @​hzlmn rewrote parser, and now parser and tokenizer work together (stream parser). As a result, we put only a few of the latest tokens in memory. So 6.0 will use less memory.

Package Size

We care about node_modules size problem. So in 6.0 @​lahmatiy and @​h0tc0d3 removed js-base64 dependency to use native Node.js and Browsers ways to base64 encoding.

Also, PostCSS was moved to babel-preset-env. Instead of regular babel, it will compile only necessary parts of ES6. So build in npm packages will be cleaner. Current browserslist config for babel-preset-env is last 1 version and node 4.

Other Changes
  • Fix error message on single : in CSS.
  • Move tests to Jest.
  • Clean up test (by @​gkal19).

v5.2.18

  • Fix TypeScript definitions for case of multiple PostCSS versions
    in node_modules (by Chris Eppstein).

v5.2.17

Compare Source

  • Add postcss-sass suggestion to syntax error on .sass input.

v5.2.16

Compare Source

  • Better error on wrong argument in node constructor.

v5.2.15

Compare Source

  • Fix TypeScript definitions (by bumbleblym).

v5.2.14

Compare Source

  • Fix browser bundle building in webpack (by janschoenherr).

v5.2.13

Compare Source

  • Do not add comment to important raws.
  • Fix JSDoc (by Dmitry Semigradsky).

v5.2.12

Compare Source

  • Fix typo in deprecation message (by Garet McKinley).

v5.2.11

Compare Source

  • Fix TypeScript definitions (by Jed Mao).

v5.2.10

Compare Source

  • Fix TypeScript definitions (by Jed Mao).

v5.2.9

Compare Source

  • Update TypeScript definitions (by Jed Mao).

v5.2.8

Compare Source

  • Fix error message (by Ben Briggs).

v5.2.7

Compare Source

  • Better error message on syntax object in plugins list.

v5.2.6

Compare Source

  • Fix postcss.vendor for values with spaces (by 刘祺).

v5.2.5

Compare Source

  • Better error message on unclosed string (by Ben Briggs).

  • If you want to rebase/retry this PR, check this box

@dev-mend-for-github-com
Copy link
Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

@dev-mend-for-github-com dev-mend-for-github-com bot added the security fix Security fix generated by Mend label Nov 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by Mend

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants