Bump postcss, autoprefixer, css-loader, cssnano and vue-loader by dependabot[bot] · Pull Request #1 · transferwise/cruise-control-ui

dependabot · 2026-04-27T15:14:59Z

Bumps postcss to 8.5.12 and updates ancestor dependencies postcss, autoprefixer, css-loader, cssnano and vue-loader. These dependencies need to be updated together.

Updates postcss from 7.0.16 to 8.5.12

Release notes

Sourced from postcss's releases.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@romainmenke during his work on Stylelint added Input#document in additional to Input#css.
root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
</tr></table> 

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

... (truncated)

Commits

9bc81c4 Release 8.5.12 version
85c4d7d Another try to fix coverage
94484ca Try to fix coverage
c64b748 Load only .map source maps
aaec7b7 Avoid throwing JSON parsing errors for non-JSON source maps
233fb26 Mention original author of the solution
2502f75 Release 8.5.11 version
5ca1901 Speed up parsing many nested brackets
42b5337 Update dependencies
7e36e15 Cache node.raws locally in Stringifier hot methods
Additional commits viewable in compare view

Updates autoprefixer from 7.2.6 to 10.5.0

Release notes

Sourced from autoprefixer's releases.

10.5.0 “Each Endeavouring, All Achieving”

Added mask-position-x and mask-position-y support (by @toporek).

10.4.27

Removed development key from package.json.

10.4.26

Reduced package size.

10.4.25

Fixed broken gradients on CSS Custom Properties (by @serger777).

10.4.24

Made Autoprefixer a little faster (by @Cherry).

10.4.23

Reduced dependencies (by @hyperz111).

10.4.22

Fixed stretch prefixes on new Can I Use database.

Updated fraction.js.

10.4.21

Fixed old -moz- prefix for :placeholder-shown (by @Marukome0743).

10.4.20

Fixed fit-content prefix for Firefox.

10.4.19

Removed end value has mixed support, consider using flex-end warning since end/start now have good support.

10.4.18

Fixed removing -webkit-box-orient on -webkit-line-clamp (@Goodwine).

10.4.17

Fixed user-select: contain prefixes.

10.4.16

Improved performance (by @romainmenke).

Fixed docs (by @coliff).

10.4.15

Fixed ::backdrop prefixes (by @yisibl).

Fixed docs (by @coliff).

10.4.14

Improved startup time and reduced JS bundle size (by @Knagis).

... (truncated)

Changelog

Sourced from autoprefixer's changelog.

10.5.0 “Each Endeavouring, All Achieving”

Added mask-position-x and mask-position-y support (by @toporek).

10.4.27

Removed development key from package.json.

10.4.26

Reduced package size.

10.4.25

Fixed broken gradients on CSS Custom Properties (by @serger777).

10.4.24

Made Autoprefixer a little faster (by @Cherry).

10.4.23

Reduced dependencies (by @hyperz111).

10.4.22

Fixed stretch prefixes on new Can I Use database.

Updated fraction.js.

10.4.21

Fixed old -moz- prefix for :placeholder-shown (by @Marukome0743).

10.4.20

Fixed fit-content prefix for Firefox.

10.4.19

Removed end value has mixed support, consider using flex-end warning since end/start now have good support.

10.4.18

Fixed removing -webkit-box-orient on -webkit-line-clamp (@Goodwine).

10.4.17

Fixed user-select: contain prefixes.

... (truncated)

Commits

faf456a Release 10.5 version
b841fc5 Update dependencies
47d6e68 Update email
45cfc08 Replace ESLint and Prettier to oxlint and oxfmt
7e3ec7d Add prefixing support for mask-position-x and mask-position-y (#1548)
360f2d9 Release 10.4.27 version
ab5260c Update clean-publish
09e9dd1 Release 10.4.26 version
ec75540 Ignore local patches
59601b8 Update c8 and clean-publish
Additional commits viewable in compare view

Updates css-loader from 3.5.2 to 7.1.4

Release notes

Sourced from css-loader's releases.

v7.1.4

7.1.4 (2026-02-16)

Bug Fixes

update peer dependency for @rspack/core v2 (#1652) (aeddefe)

v7.1.3

7.1.3 (2026-01-27)

Bug Fixes

allow to use module class name (#1649) (01869bc)

use official createHash for hashes (#1618) (06587e5)

use official hash* options for hashes (#1619) (9544c3e)

v7.1.2

7.1.2 (2024-05-22)

Bug Fixes

keep order of @imports with the webpackIgnore comment (#1600) (76757ef)

v7.1.1

7.1.1 (2024-04-10)

Bug Fixes

automatically rename class default to _default when named export is enabled (#1590) (d6c31a1)

v7.1.0

7.1.0 (2024-04-08)

Features

added the getJSON option to output CSS modules mapping (#1577) (af834b4)

v7.0.0

7.0.0 (2024-04-04)

⚠ BREAKING CHANGES

The modules.namedExport option is true by default if you enable the esModule option

... (truncated)

Changelog

Sourced from css-loader's changelog.

7.1.4 (2026-02-16)

Bug Fixes

update peer dependency for @rspack/core v2 (#1652) (aeddefe)

7.1.3 (2026-01-27)

Bug Fixes

allow to use module class name (#1649) (01869bc)

use official createHash for hashes (#1618) (06587e5)

use official hash* options for hashes (#1619) (9544c3e)

7.1.2 (2024-05-22)

Bug Fixes

keep order of @imports with the webpackIgnore comment (#1600) (76757ef)

7.1.1 (2024-04-10)

Bug Fixes

automatically rename class default to _default when named export is enabled (#1590) (d6c31a1)

7.1.0 (2024-04-08)

Features

added the getJSON option to output CSS modules mapping (#1577) (af834b4)

7.0.0 (2024-04-04)

⚠ BREAKING CHANGES

The modules.namedExport option is true by default if you enable the esModule option

Migration guide:

Before:
import style from "./style.css";
</tr></table> 

... (truncated)

Commits

5b795af chore(release): 7.1.4
aeddefe fix: update peer dependency for @rspack/core v2 (#1652)
b2b2de7 chore(release): 7.1.3
01869bc fix: allow to use module class name (#1649)
7dd15ec chore(deps): bump js-yaml (#1648)
db26202 chore(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#1647)
7daf1b8 Update CONTRIBUTING link to point to GitHub page
de1e633 chore: correct link path (#1645)
563ad63 chore: migrate from contrib and swap branches (#1644)
e68bf7e chore: update github actions/checkout from v4 to v5 (#1642)
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates cssnano from 4.1.10 to 7.1.7

Release notes

Sourced from cssnano's releases.

v.7.1.7

This release is idnetical to the previous one, but is being published to ensure that the latest versions of postcss-normalize-repeat-style and postcss-normalize-positions are uploaded to the npm registry.

v7.1.6

New feature

feat(postcss-minify-selectors): fold selector lists into :is() (#1703) by @dkryaklin in cssnano/cssnano#1775

Bug fixes

fix: update colordx and autoprefixer

fix: update postcss peer dependency by @ludofischer in cssnano/cssnano#1779 Solves possible security issue

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.5...cssnano@7.1.6

v7.1.5

Bug Fixes

fix(postcss-reduce-idents): support counter-set property by @dkryaklin in cssnano/cssnano#1765

fix(postcss-convert-values): add transformCustomProperties option by @dkryaklin in cssnano/cssnano#1769

fix(postcss-colormin): add transformCustomProperties option by @dkryaklin in cssnano/cssnano#1768

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.4...cssnano@7.1.5

v7.1.4

Bug Fixes

Update color conversion library to @colordx/core to fix rounding errors in color conversions #1755

v7.1.3

What's Changed

Optimize mergeRule selector merging with WeakMap caching by @Goodwine in cssnano/cssnano#1748

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.2...cssnano@7.1.3

v7.1.2

What's Changed

fix: enhanced recognition of css comments by @Nirvana-Jie in cssnano/cssnano#1730

chore: use npm trusted publishing by @ludofischer in cssnano/cssnano#1731

fix: update browserslist by @ludofischer in cssnano/cssnano#1733

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.1...cssnano@7.1.2

v71.1.1

Bug Fixes

fix(convert-values): exclude linear() from stripping % from value 0 by @cernymatej in cssnano/cssnano#1720

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.0...cssnano@7.1.1

... (truncated)

Commits

6afa2c9 chore: create new versions to fix missing dependencies
80e57b9 Publish cssnano 7.1.6
322ad33 fix: update postcss peer dependency
587f28d chore: pin codecov action
560b0fa chore: improve CI security
0fb105b fix: update postcss
3b6cf88 chore: update development deps
a133ac0 chore: update TypeScript
730b04b fix: update autoprefixer
a00036c fix: update colordx
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cssnano since your current version.

Updates vue-loader from 13.7.3 to 17.4.2

Release notes

Sourced from vue-loader's releases.

v17.3.1

Bug Fixes

do not skip style post loader for v-bind() in non-scoped CSS (d7071bb), closes #2061

v17.3.0

Bug Fixes

re-use ident of vue rule for template compiler, fixes #2029 (#2030) (b50fa56)

Features

skip normal css files without scoped flag in stylePostLoader (#2053) (98782e7)

v17.2.2

Bug Fixes

fix: windows path for experiments.css by @h-a-n-a in vuejs/vue-loader#2049

v17.2.1

Features

A new experimentalInlineMatchResource option (webpack 5 only), which leverages webpack 5's inline matchResource feature in the underlying implementation, and works well with the experiments.css feature This also makes vue-loader compatible with Rspack (#2046) (3149f6d).

Note: v17.2.0 was released by accident; it has the same content as v17.1.2, therefore not included in the Releases page.

v17.1.2

Bug Fixes

keep build stable when run in a different path (#2040) (a81dc0f)

properly close the watcher after webpack 4 tests (40b93b9)

v17.1.1

Bug Fixes

support experimental propsDestructure and defineModel options (6269698)

v17.1.0

Bug Fixes

fix: reference project compiler, fixes #2031 by @heywhy in vuejs/vue-loader#2038

fix: do not throw when Rule.layer is used by @nolimitdev in vuejs/vue-loader#2000

Features

support 3.3 imported types hmr (bbd98fc)

Full Changelog: vuejs/vue-loader@v17.0.1...v17.1.0

... (truncated)

Changelog

Sourced from vue-loader's changelog.

17.4.2 (2023-12-30)

Bug Fixes

pass compilerOptions to sfc parse & re-enable AST reuse (d2a2e05)

17.4.1 (2023-12-30)

Bug Fixes

(temporarily) disable template ast reuse (31b03af)

17.4.0 (2023-12-25)

Features

leverage ast reuse in 3.4 (479835f)

17.3.1 (2023-10-31)

Bug Fixes

do not skip style post loader for v-bind() in CSS (d7071bb), closes #2061

17.3.0 (2023-10-07)

Bug Fixes

re-use ident of vue rule for template compiler, fixes #2029 (#2030) (b50fa56)

Features

skip normal css files without scoped flag in stylePostLoader (#2053) (98782e7)

17.2.2 (2023-06-02)

... (truncated)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [postcss](https://github.com/postcss/postcss) to 8.5.12 and updates ancestor dependencies [postcss](https://github.com/postcss/postcss), [autoprefixer](https://github.com/postcss/autoprefixer), [css-loader](https://github.com/webpack/css-loader), [cssnano](https://github.com/cssnano/cssnano) and [vue-loader](https://github.com/vuejs/vue-loader). These dependencies need to be updated together. Updates `postcss` from 7.0.16 to 8.5.12 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@7.0.16...8.5.12) Updates `autoprefixer` from 7.2.6 to 10.5.0 - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](postcss/autoprefixer@7.2.6...10.5.0) Updates `css-loader` from 3.5.2 to 7.1.4 - [Release notes](https://github.com/webpack/css-loader/releases) - [Changelog](https://github.com/webpack/css-loader/blob/main/CHANGELOG.md) - [Commits](webpack/css-loader@v3.5.2...v7.1.4) Updates `cssnano` from 4.1.10 to 7.1.7 - [Release notes](https://github.com/cssnano/cssnano/releases) - [Commits](https://github.com/cssnano/cssnano/compare/v4.1.10...cssnano@7.1.7) Updates `vue-loader` from 13.7.3 to 17.4.2 - [Release notes](https://github.com/vuejs/vue-loader/releases) - [Changelog](https://github.com/vuejs/vue-loader/blob/main/CHANGELOG.md) - [Commits](https://github.com/vuejs/vue-loader/commits/v17.4.2) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.12 dependency-type: indirect - dependency-name: autoprefixer dependency-version: 10.5.0 dependency-type: direct:development - dependency-name: css-loader dependency-version: 7.1.4 dependency-type: direct:development - dependency-name: cssnano dependency-version: 7.1.7 dependency-type: direct:development - dependency-name: vue-loader dependency-version: 17.4.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot AI review requested due to automatic review settings April 27, 2026 15:15

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 27, 2026

dependabot Bot review requested due to automatic review settings April 27, 2026 15:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump postcss, autoprefixer, css-loader, cssnano and vue-loader#1

Bump postcss, autoprefixer, css-loader, cssnano and vue-loader#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-1adf6a5519

dependabot Bot commented on behalf of github Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 27, 2026

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.3

8.5.2

8.5.1

8.5 “Duke Alloces”

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.3

8.5.2

8.5.1

10.5.0 “Each Endeavouring, All Achieving”

10.4.27

10.4.26

10.4.25

10.4.24

10.4.23

10.4.22

10.4.21

10.4.20

10.4.19

10.4.18

10.4.17

10.4.16

10.4.15

10.4.14

10.5.0 “Each Endeavouring, All Achieving”

10.4.27

10.4.26

10.4.25

10.4.24

10.4.23

10.4.22

10.4.21

10.4.20

10.4.19

10.4.18

10.4.17

v7.1.4

7.1.4 (2026-02-16)

Bug Fixes

v7.1.3

7.1.3 (2026-01-27)

Bug Fixes

v7.1.2

7.1.2 (2024-05-22)

Bug Fixes

v7.1.1

7.1.1 (2024-04-10)

Bug Fixes

v7.1.0

7.1.0 (2024-04-08)

Features

v7.0.0

7.0.0 (2024-04-04)

⚠ BREAKING CHANGES

7.1.4 (2026-02-16)

Bug Fixes

7.1.3 (2026-01-27)

Bug Fixes

7.1.2 (2024-05-22)

Bug Fixes

7.1.1 (2024-04-10)

Bug Fixes