fix(deps): update dependency postcss to v8.5.16

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
postcss (source)	8.4.32 → 8.5.16

---

Release Notes

postcss/postcss (postcss)

v8.5.16

Compare Source

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

v8.5.15

Compare Source

• Fixed declaration parsing performance (by @​homanp).

v8.5.14

Compare Source

• Fixed custom syntax regression (by @​43081j).

v8.5.13

Compare Source

• Fixed postcss-scss commend regression.

v8.5.12

Compare Source

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

v8.5.11

Compare Source

• Fixed nested brackets parsing performance (by @​offset).

v8.5.10

Compare Source

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

v8.5.9

Compare Source

• Speed up source map encoding paring in case of the error.

v8.5.8

Compare Source

• Fixed Processor#version.

v8.5.7

Compare Source

• Improved source map annotation cleaning performance (by CodeAnt AI).

v8.5.6

Compare Source

• Fixed ContainerWithChildren type discriminating (by @​Goodwine).

v8.5.5

Compare Source

• Fixed package.json→exports compatibility with some tools (by @​JounQin).

v8.5.4

Compare Source

• Fixed Parcel compatibility issue (by @​git-sumitchaudhary).

v8.5.3

Compare Source

• Added more details to Unknown word error (by @​hiepxanh).
• Fixed types (by @​romainmenke).
• Fixed docs (by @​catnipan).

v8.5.2

Compare Source

• Fixed end position of rules with semicolon (by @​romainmenke).

v8.5.1

Compare Source

• Fixed declaration parsing performance (by @​homanp).

v8.5.0: 8.5 “Duke Alloces”

Compare Source

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@​romainmenke during his work on Stylelint added Input#document in additional to Input#css.

root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"

Thanks to Sponsors

This release was possible thanks to our community.

If your company wants to support the sustainability of front-end infrastructure or wants to give some love to PostCSS, you can join our supporters by:

• Tidelift with a Spotify-like subscription model supporting all projects from your lock file.
• Direct donations at GitHub Sponsors or Open Collective.

v8.4.49

Compare Source

• Fixed custom syntax without source.offset (by @​romainmenke).

v8.4.48

Compare Source

• Fixed position calculation in error/warnings methods (by @​romainmenke).

v8.4.47

Compare Source

• Removed debug code.

v8.4.46

Compare Source

• Fixed Cannot read properties of undefined (reading 'before').

v8.4.45

Compare Source

• Removed unnecessary fix which could lead to infinite loop.

v8.4.44

Compare Source

• Another way to fix markClean is not a function error.

v8.4.43

Compare Source

• Fixed markClean is not a function error.

v8.4.42

Compare Source

• Fixed CSS syntax error on long minified files (by @​varpstar).

v8.4.41

Compare Source

• Fixed types (by @​nex3 and @​querkmachine).
• Cleaned up RegExps (by @​bluwy).

v8.4.40

Compare Source

• Moved to getter/setter in nodes types to help Sass team (by @​nex3).

v8.4.39

Compare Source

• Fixed CssSyntaxError types (by @​romainmenke).

v8.4.38

Compare Source

• Fixed endIndex: 0 in errors and warnings (by @​romainmenke).

v8.4.37

Compare Source

• Fixed original.column are not numbers error in another case.

v8.4.36

Compare Source

• Fixed original.column are not numbers error on broken previous source map.

v8.4.35

Compare Source

• Avoid ! in node.parent.nodes type.
• Allow to pass undefined to node adding method to simplify types.

v8.4.34

Compare Source

• Fixed AtRule#nodes type (by Tim Weißenfels).
• Cleaned up code (by Dmitry Kirillov).

v8.4.33

Compare Source

• Fixed NoWorkResult behavior difference with normal mode (by Romain Menke).
• Fixed NoWorkResult usage conditions (by @​ahmdammarr).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
background-eraser	Ready	Preview, Comment	Jun 28, 2026 4:40pm

[secure-code-warrior-for-github]

Micro-Learning Topic: Cross-site scripting (Detected by phrase)

Matched on "XSS"

Cross-site scripting vulnerabilities occur when unescaped input is rendered into a page displayed to the user. When HTML or script is included in the input, it will be processed by a user's browser as HTML or script and can alter the appearance of the page or execute malicious scripts in their user context.

Try a challenge in Secure Code Warrior

Helpful references

• Prevent Cross-Site Scripting (XSS) in ASP.NET Core - A detailed Microsoft article on how to prevent cross-site scripting in ASP.NET Core.
• OWASP Cross Site Scripting (XSS) Software Attack - OWASP community page with comprehensive information about cross site scripting, and links to various OWASP resources to help detect or prevent it.
• OWASP Cross Site Scripting Prevention Cheat Sheet - This article provides a simple positive model for preventing XSS using output encoding properly.