chore(deps-dev): bump postcss from 8.5.12 to 8.5.18 by dependabot[bot] · Pull Request #20923 · mozilla/fxa

dependabot · 2026-07-27T14:51:30Z

Bumps postcss from 8.5.12 to 8.5.18.

Release notes

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

Changelog

Sourced from postcss's changelog.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

Commits

4c0d194 Release 8.5.18 version
92b4e78 Update dependencies
95663d3 Limit where source map can be loaded for security reasons
74e25ae Release 8.5.17 version
d1518af Fix Maximum call stack size exceeded error
2421312 Fix linter
a50352c Fix CI
33948f0 Prevent prototype hijacking in fromJSON
2131909 Update dependencies
93440ab Fix non-closed \<div align="center"> in README (#2110)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

mozilla-blender · 2026-07-27T15:33:16Z

BLEnder: will not auto-merge (CI has 2 pending check(s)).

mozilla-blender · 2026-07-28T18:08:43Z

Note: This PR has failing CircleCI checks.
BLEnder cannot access CircleCI log output, so it
may not be able to diagnose or fix the failure.
Consider migrating CI to GitHub Actions so BLEnder
can read failure logs directly.

mozilla-blender · 2026-07-28T18:08:43Z

BLEnder picked up this PR. Workflow run

mozilla-blender · 2026-07-28T21:48:24Z

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

postcss is used in the FxA monorepo purely as a build-time CSS toolchain (tailwindcss, autoprefixer, postcss-loader/cli, postcss-preset-env, Next.js/storybook/webpack). There are no direct imports of the postcss API in application or library source, and the app never parses user-submitted CSS at runtime nor re-stringifies postcss output into HTML <style> tags — the exact prerequisites for this XSS advisory. The two direct declarations (root 8.5.12, fxa-settings ^8.5.12 -> 8.5.14) are already at or above the patched 8.5.10; only stale transitive build-time resolutions (e.g. 8.5.6, 8.4.31, 7.x, 6.x) remain in the vulnerable range, and those never touch untrusted CSS at runtime. Therefore the repository's code is not affected.

This PR can be reviewed and merged as a normal dependency update.

mozilla-blender · 2026-07-28T22:12:01Z

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

postcss 8.5.12 is installed (within the vulnerable <=8.5.17 range), but it is used exclusively as build-time CSS tooling — Tailwind, autoprefixer, webpack postcss-loader, Next.js, and Storybook — operating only on the project's own first-party stylesheets. No first-party source imports postcss to call .process()/.parse() on untrusted, user-submitted CSS at runtime, which is the necessary precondition for this sourceMappingURL path-traversal disclosure. The vulnerable code path (attacker-controlled CSS -> auto-loaded previous source map -> disclosed sourcesContent in result.map) is never exercised, so there is no exploitable runtime impact.

This PR can be reviewed and merged as a normal dependency update.

mozilla-blender · 2026-07-28T22:14:20Z

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

postcss is used only as build-time CSS tooling (Tailwind, webpack/postcss-loader, Next.js) operating on static, repo-controlled stylesheets. No FxA source code imports postcss directly or calls postcss().process() on attacker-controlled/untrusted CSS, so the vulnerable PreviousMap sourceMappingURL file-read path is never triggered. The direct declarations are already at the patched 8.5.12/8.5.14; some transitive copies still resolve to vulnerable 8.5.6/8.4.31 in yarn.lock, but they run only at build time against trusted input, giving no runtime attack surface.

This PR can be reviewed and merged as a normal dependency update.

Bumps [postcss](https://github.com/postcss/postcss) from 8.5.12 to 8.5.18. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.12...8.5.18) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.18 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

The preinstall Node version check read the exact pin 24.15.0 from .nvmrc and passed it straight to semver.satisfies, which treats a bare version as an exact-match range. That rejected the CI runner's Node 24.18.0 even though package.json engines allows ^24.15.0, failing yarn install for the PR. The check now widens an exact .nvmrc pin to a caret range (^24.15.0) so any compatible Node within the same major satisfies it, matching engines and the script's fallback major-version check.

Because: * The BLEnder fix commit (bd91a6d) changed the file mode from 100755 to 100644 alongside its semver change. Yarn's root-workspace postinstall then fails with "permission denied: _scripts/check-node-version.sh" (exit code 128), so Init (PR) never completes. This commit: * Restores mode 755. No content change.

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 84%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 85%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 85%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 85%, no advisories).

mozilla-blender · 2026-07-30T21:56:30Z

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

postcss is present only as a build-time devDependency (root package.json and fxa-settings) used by the Tailwind/autoprefixer/webpack/Next.js CSS toolchain via standard postcss.config.js plugin pipelines. The vulnerable path (postcss.parse()/process() on untrusted CSS at runtime with source-map auto-loading) is never exercised: a repo-wide grep found zero runtime imports or calls to postcss in application source, and PostCSS only processes the repo's own trusted first-party CSS at build time. Installed versions (8.5.6/8.5.12/8.5.14/8.5.16) fall in the vulnerable <=8.5.17 range, so scanners will flag it, but there is no attacker-controlled-CSS code path, making it non-exploitable.

This PR can be reviewed and merged as a normal dependency update.

mozilla-blender · 2026-07-30T21:59:43Z

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

postcss is used exclusively as build-time tooling in fxa (tailwindcss, autoprefixer, stylelint, postcss-loader/cli, storybook/webpack). The direct root devDependency is pinned to 8.5.12 and fxa-settings resolves 8.5.14 — both already patched. The advisory's XSS requires parsing user-submitted CSS, re-stringifying it, and embedding the output in an HTML <style> tag at runtime (plus a malicious plugin); no such runtime code path exists here. All CSS processed is static, first-party, developer-authored stylesheets compiled to static .out.css. Some transitive copies below 8.5.10 exist in yarn.lock (e.g. 8.5.6 via the tailwind chain, plus legacy 6.x/7.x/8.4.31), but they are only exercised during builds on trusted input, so the vulnerable path is not reachable.

This PR can be reviewed and merged as a normal dependency update.

mozilla-blender · 2026-07-30T22:00:03Z

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

postcss is a build-time-only dependency in the fxa monorepo (Tailwind/PostCSS CLI, postcss-loader, Next.js PostCSS pipeline), used exclusively to compile first-party stylesheets during CI/build. The vulnerability requires attacker-controlled CSS to be passed to postcss().process(); no such runtime call on untrusted input exists anywhere in the codebase. The two direct declarations are already on patched versions (root 8.5.12, fxa-settings 8.5.14). Only transitive build-tooling copies (8.5.6, 8.4.31, 7.x, 6.x) fall in the vulnerable range, and none process untrusted CSS or execute at application runtime, so there is no exploitable path.

This PR can be reviewed and merged as a normal dependency update.

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 84%, no advisories).

mozilla-blender · 2026-07-30T22:10:41Z

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

postcss is used in fxa only as build-time CSS tooling (Tailwind CLI, postcss-loader, postcss-cli, postcss-preset-env, storybook), processing the repository's own trusted source stylesheets. The vulnerability requires attacker-controlled CSS to reach postcss().process() so that a malicious sourceMappingURL comment triggers a filesystem read; fxa (an auth/payments service) exposes no runtime path that accepts user-supplied CSS and passes it to postcss. The two direct declarations are already at patched versions (root devDependency pinned to 8.5.12; fxa-settings ^8.5.12 -> 8.5.14). Remaining sub-8.5.12 copies (8.5.6, 8.4.31, 7.0.39, 6.0.23) are transitive build-tool dependencies never fed untrusted input. No vulnerable code path is exercised.

This PR can be reviewed and merged as a normal dependency update.

mozilla-blender · 2026-07-30T22:12:36Z

BLEnder investigated: This dependency has an open security alert, but the repo is not affected.

In the FxA monorepo, postcss is used solely as build-time CSS tooling (tailwindcss, autoprefixer, postcss-loader, postcss-preset-env, next/webpack/storybook bundling). The vulnerable resolved versions (8.4.31, 8.5.6, and legacy 6.0.23/7.0.39) are all transitive build dependencies; the two direct declarations (root devDependency and fxa-settings dependency) are already >= 8.5.10 (resolving to 8.5.12/8.5.14). The XSS requires parsing UNTRUSTED user-submitted CSS via postcss.parse() and re-stringifying it into an HTML <style> tag at runtime. FxA has no such user-CSS ingestion surface, and no application/library source code invokes the postcss stringify API at runtime — every touchpoint is a postcss.config.js build pipeline. The vulnerable </style> path is therefore not reachable at runtime; this is a build-dependency hygiene issue only.

This PR can be reviewed and merged as a normal dependency update.

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 84%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 84%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 85%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 85%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 85%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 76%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 76%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 76%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 76%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 76%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 77%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 76%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 75%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 74%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 74%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 74%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 74%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 75%, no advisories).

mozilla-blender

BLEnder auto-merge: all safety gates passed (CI green, patch/minor, compat 75%, no advisories).

mozilla-blender · 2026-08-03T17:21:34Z

@dependabot recreate

dependabot · 2026-08-03T17:21:36Z

Sorry, only users with push access can use that command.

dependabot · 2026-08-04T17:30:17Z

A newer version of postcss exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

dependabot Bot added dependencies Pull requests that update a dependency file maintenance labels Jul 27, 2026

dependabot Bot requested a review from a team as a code owner July 27, 2026 14:51

dependabot Bot added dependencies Pull requests that update a dependency file maintenance labels Jul 27, 2026

dependabot Bot and others added 3 commits July 30, 2026 15:29

vbudhram force-pushed the dependabot/npm_and_yarn/postcss-8.5.18 branch from 122e266 to 6567934 Compare July 30, 2026 19:30

mozilla-blender Bot approved these changes Jul 30, 2026

View reviewed changes

mozilla-blender Bot approved these changes Jul 31, 2026

View reviewed changes

mozilla-blender Bot approved these changes Aug 2, 2026

View reviewed changes

mozilla-blender Bot approved these changes Aug 3, 2026

View reviewed changes

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

Uh oh!

mozilla-blender Bot commented Jul 27, 2026

Uh oh!

mozilla-blender Bot commented Jul 28, 2026

Uh oh!

mozilla-blender Bot commented Jul 28, 2026

Uh oh!

mozilla-blender Bot commented Jul 28, 2026

Uh oh!

mozilla-blender Bot commented Jul 28, 2026

Uh oh!

mozilla-blender Bot commented Jul 28, 2026

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot commented Jul 30, 2026

Uh oh!

mozilla-blender Bot commented Jul 30, 2026

Uh oh!

mozilla-blender Bot commented Jul 30, 2026

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot commented Jul 30, 2026

Uh oh!

mozilla-blender Bot commented Jul 30, 2026

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mozilla-blender Bot left a comment

Choose a reason for hiding this comment

Uh oh!