Bump postcss, autoprefixer and postcss-cli

[dependabot]

Bumps postcss to 8.5.26 and updates ancestor dependencies postcss, autoprefixer and postcss-cli. These dependencies need to be updated together.

Updates postcss from 7.0.38 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).

... (truncated)

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates autoprefixer from 9.8.5 to 10.5.4

Release notes

Sourced from autoprefixer's releases.

10.5.4

• Fixed prefixed rule duplication (by @​xianjianlf2).

10.5.3

• Fixed brackets and gradient parser (@​alanturing881).

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

10.4.23

• Reduced dependencies (by @​hyperz111).

10.4.22

• Fixed stretch prefixes on new Can I Use database.
• Updated fraction.js.

10.4.21

• Fixed old -moz- prefix for :placeholder-shown (by @​Marukome0743).

10.4.20

• Fixed fit-content prefix for Firefox.

10.4.19

• Removed end value has mixed support, consider using flex-end warning since end/start now have good support.

10.4.18

• Fixed removing -webkit-box-orient on -webkit-line-clamp (@​Goodwine).

10.4.17

... (truncated)

Changelog

Sourced from autoprefixer's changelog.

10.5.4

• Fixed prefixed rule duplication (by @​xianjianlf2).

10.5.3

• Fixed brackets and gradient parser (@​alanturing881).

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

10.5.0 “Each Endeavouring, All Achieving”

• Added mask-position-x and mask-position-y support (by @​toporek).

10.4.27

• Removed development key from package.json.

10.4.26

• Reduced package size.

10.4.25

• Fixed broken gradients on CSS Custom Properties (by @​serger777).

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

10.4.23

• Reduced dependencies (by @​hyperz111).

10.4.22

• Fixed stretch prefixes on new Can I Use database.
• Updated fraction.js.

10.4.21

• Fixed old -moz- prefix for :placeholder-shown (by @​Marukome0743).

... (truncated)

Commits

• 4cad00f Release 10.5.4 version
• e62a4b1 Update CI config
• c8f0d0a Update dependencies
• cae3577 Move back to latest pnpm 11
• fd31eb3 Fix duplicated prefixed selectors on reformatted CSS (#1552)
• 958d390 Release 10.5.3 version
• 21d2adb Fix gradient parser
• f7ddae9 Fix bracket parser
• 10ea5e7 Update dependencies and remove patch
• b6e8a2a Update Dev Container
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for autoprefixer since your current version.

Updates postcss-cli from 7.1.2 to 11.0.1

Release notes

Sourced from postcss-cli's releases.

8.0.0 / 2020-09-21

• BREAKING: Support postcss v8 (#344, #349)
• BREAKING: postcss is now a peerDependency, you must install it seperately (#344, #349)
• Upgrade dependencies (#340)

Changelog

Sourced from postcss-cli's changelog.

11.0.1 / 2025-03-12

• Update and minimize dependencies

11.0.0 / 2023-12-05

• BREAKING: Require Node.js v18+ (#464)
• Upgrade to postcss-load-config@5 for improved ESM & TS config support (#461, #462)

10.1.0 / 2022-11-29

• Allow running --watch mode in non-TTY contexts, like Docker (#448)
• Update dependencies

10.0.0 / 2022-06-29

• BREAKING: Drop Node 12 support (#438)
• Add support for ESM config files (#437)

9.1.0 / 2021-12-10

• Don't write to files if they're unchanged (#320, #417)

9.0.2 / 2021-11-04

• Switch to picocolors (#409)
• Remove test files from npm package

9.0.1 / 2021-09-28

• Actually exit with error when attempting to stdout in watch mode
• Remove bin/ from files in package.json

9.0.0 / 2021-09-24

• BREAKING: Require Node.js v12+
• BREAKING: Must specify full file path, including .js extension, when loading local plugins with --use (#401)
• BREAKING: Officially remove support for watching postcss config (was already broken in previous releases)
• Add support for dir-dependency messages (#383, #391)
• Update deps

8.3.1 / 2020-12-12

• Ensure paths are not interpreted as numbers (#360)
• Better errors for incorrect postcss version (#361, #362)

8.3.0 / 2020-11-17

• Exit on EOF/^D (#358)

... (truncated)

Commits

• 7bea180 11.0.1
• 0dc4eba Use eslint v9 + flat config (#490)
• 733ef42 chore(deps): update dependency sugarss to v5 (#483)
• 1363a65 Update dependency prettier to ~3.5.0 (#488)
• bd416f5 Update dependency uuid to v11 (#482)
• bfad16d Update dependency c8 to v10 (#480)
• b5d8f0e feat: replace globby with tinyglobby and remove get-stdin in favor of builtin...
• 5f9f92a Update dependency prettier to ~3.4.0 (#484)
• 0f52be7 Update dependency prettier to ~3.3.0 (#477)
• 528af4c Adding link to PostCSS (#472)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[Vad1mo]

This breaks the build. postcss-cli 8+ and autoprefixer 10+ declare postcss as a peerDependency, but this PR does not add postcss to package.json dependencies, and the updated yarn.lock contains no postcss resolution at all. Netlify builds with yarn because yarn.lock is committed, and yarn 1 does not install peer deps.

Reproduced locally with this PR's package.json:

warning " > autoprefixer@10.6.1" has unmet peer dependency "postcss@^8.1.0".
warning " > postcss-cli@11.0.1" has unmet peer dependency "postcss@^8.0.0".
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'postcss' imported from node_modules/postcss-cli/index.js

Hugo shells out to node_modules/.bin/postcss for the postCSS pipe in layouts/partials/css.html, so this fails the site build. That is consistent with all three Netlify checks failing here while the lock-only dependabot PRs pass.

Required changes:

1. Add "postcss": "^8.5.26" to the dependencies block in package.json.
2. Regenerate both package-lock.json and yarn.lock so postcss 8 is resolved in each. The npm lockfile currently hides the problem because npm auto-installs peers; the yarn lockfile is the one Netlify uses.
3. postcss-cli@11.0.1 declares engines: {"node": ">=18"} while .nvmrc on main is v14.11.0. The Node bump needs to land with this or before it.
4. Rebase onto current main; this branch is based on 2d9215b and two js-yaml lock bumps have landed since.

Dependabot will not add a new direct dependency on its own, so this likely needs to be redone as a manual PR. Note #744 bumps the same two packages to the same versions and has the same Node constraint.