build(deps): Bump postcss from 8.5.15 to 8.5.24

[dependabot]

Bumps postcss from 8.5.15 to 8.5.24.

Release notes

Sourced from postcss's releases.

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Commits

• 0ebe8ad Release 8.5.24 version
• 73218c6 Update dependencies
• 9a114f6 Preserve the BOM when stringifying (#2119)
• 9069261 Fix types check
• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

---

Note

Low Risk
Routine transitive dependency patch upgrade with no direct code changes; minor risk if custom PostCSS pipelines relied on previous source-map loading behavior.

Overview
Updates the lockfile so the resolved postcss package moves from 8.5.15 to 8.5.24, with nanoid bumped from 3.3.12 to 3.3.16 as postcss’s dependency. There are no application source changes—only package-lock.json.

The newer postcss line includes source-map loading hardening (maps tied to opts.from / folder restrictions), fixes for AST/serialization edge cases (comments, semicolons, fromJSON prototype issues), and BOM preservation on output in 8.5.24.

^{Reviewed by Cursor Bugbot for commit 8944be8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the postcss 8.5.15→8.5.24 bump for supply-chain compromise indicators against the malware scan and upstream diffs.Verdict: benign

Patch bump of the well-known postcss package (8.5.15 → 8.5.24) with tagged releases by Andrey Sitnik. Changes are bugfixes plus intentional security hardening (source-map path restrictions, no map load without opts.from, fromJSON prototype-hijack fix, BOM preservation).

Scanner evidence (status: warn): 0 unicode / confusable / IOC findings. All 32 heuristics are false positives: cross-spawn in upstream pnpm-lock.yaml, “token” substring in docs plugin names, and normal source-map base64 encode/decode.

Integrity: Runtime deps unchanged except nanoid patch; no preinstall/install/postinstall scripts. Upstream .github/workflows edits are CI/trusted-publishing cleanup (explains the new npm “GitHub Actions” publisher), not shipped in the npm tarball consumed by this repo. No typosquatting or dependency-graph explosion.

Compatibility Analysis

I'll analyze how postcss is used in this repo and whether the 8.5.15→8.5.24 changes affect those paths.Recommendation: merge (optional smoke-test: npm run build)

1) Where it’s used

postcss is not a direct dependency of chia-docs (package.json has no postcss entry, no postcss.config.*, no app imports).

It is a transitive build-time dep via the Docusaurus/webpack CSS stack (css-loader, postcss-loader, autoprefixer, postcss-preset-env, cssnano, and related @csstools/* plugins). Site CSS is ordinary (src/css/custom.css, two *.module.css files).

2) Overlap with changed APIs

Patch bump 8.5.15 → 8.5.24. Relevant upstream changes vs this repo’s usage:

Change	Hits this repo?
Source-map load restricted to opts.from dir; skip map load without from (unsafeMap opt-out)	Unlikely — webpack loaders supply file paths / inline maps
fromJSON stack/prototype fixes	No — no app/fromJSON usage
BOM preserved on stringify	Negligible — only if CSS has a UTF-8 BOM
Semicolon / AtRule#params / root raws / Input#origin / rangeBy fixes	Indirect via tooling only; bugfixes, not breaking API

No local code calls the hardened or fixed APIs directly.

3) Risks / unknowns

• Theoretical: previous-map files outside the CSS file’s directory without unsafeMap: true would stop loading (security harden). Normal Docusaurus CSS builds don’t rely on that.
• Unknown until CI: confirm docusaurus build still succeeds (standard Dependabot check).

4) Verdict

merge — transitive patch with security/bugfix changes; no app-level API surface; low compatibility risk for this docs site.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 35
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 1
• Resolved upstream range: eae46db765d752cf8f40c4fa2b0b85030079c43d..0ebe8ad591621ab4e48311da47a76974617571f9
• Resolved refs: from=eae46db765d752cf8f40c4fa2b0b85030079c43d to=0ebe8ad591621ab4e48311da47a76974617571f9
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 32

Top findings

• pnpm-lock.yaml:883 shell_process_spawn :: cross-spawn@7.0.6:
• pnpm-lock.yaml:2250 shell_process_spawn :: cross-spawn@7.0.6:
• pnpm-lock.yaml:2418 shell_process_spawn :: cross-spawn: 7.0.6
• pnpm-lock.yaml:2508 shell_process_spawn :: cross-spawn: 7.0.6
• docs/plugins.md:954 credential_exfil_indicator :: [postcss-design-tokens]: https://github.com/jptaranto/postcss-design-tokens
• docs/plugins.md:956 credential_exfil_indicator :: [@csstools/postcss-design-tokens]: https://github.com/csstools/postcss-plugins/tree/main/plugins/postcss-design-tokens
• CHANGELOG.md:697 credential_exfil_indicator :: - Fix tokenizer for postcss-less (by Matt Lyons).
• test/map.test.ts:242 obfuscation_indicator :: let base64 = Buffer.from(separated.map.toString()).toString('base64')
• test/map.test.ts:243 obfuscation_indicator :: let end = inline.css.slice(-base64.length - 3)
• test/map.test.ts:244 obfuscation_indicator :: is(end, base64 + ' */')
• test/previous-map.test.ts:86 obfuscation_indicator :: test('decodes base64 maps', () => {
• test/previous-map.test.ts:87 obfuscation_indicator :: let b64 = Buffer.from(map).toString('base64')
• test/previous-map.test.ts:89 obfuscation_indicator :: 'a{}\n' + /*# sourceMappingURL=data:application/json;base64,${b64} */
• test/previous-map.test.ts:94 obfuscation_indicator :: test('decodes base64 UTF-8 maps', () => {
• test/previous-map.test.ts:95 obfuscation_indicator :: let b64 = Buffer.from(map).toString('base64')
• test/previous-map.test.ts:98 obfuscation_indicator :: 'charset=utf-8;base64,' +
• test/previous-map.test.ts:105 obfuscation_indicator :: test('accepts different name for base64 maps with UTF-8 encoding', () => {
• test/previous-map.test.ts:106 obfuscation_indicator :: let b64 = Buffer.from(map).toString('base64')
• test/previous-map.test.ts:109 obfuscation_indicator :: 'charset=utf8;base64,' +
• lib/postcss.d.ts:288 obfuscation_indicator :: * as a Base64-encoded comment. By default, it is true.