chore(deps-dev): bump postcss from 8.5.10 to 8.5.18

[dependabot]

Bumps postcss from 8.5.10 to 8.5.18.

Release notes

Sourced from postcss's releases.

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

Changelog

Sourced from postcss's changelog.

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

Commits

• 4c0d194 Release 8.5.18 version
• 92b4e78 Update dependencies
• 95663d3 Limit where source map can be loaded for security reasons
• 74e25ae Release 8.5.17 version
• d1518af Fix Maximum call stack size exceeded error
• 2421312 Fix linter
• a50352c Fix CI
• 33948f0 Prevent prototype hijacking in fromJSON
• 2131909 Update dependencies
• 93440ab Fix non-closed \<div align="center"> in README (#2110)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[greptile-apps]

PR author is in the excluded authors list.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hyperdx-oss	Ready	Preview, Comment	Jul 24, 2026 9:57pm
hyperdx-storybook	Ready	Preview, Comment	Jul 24, 2026 9:57pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: b58dc6c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🟢 Tier 1 — Trivial

Docs, images, lock files, or a dependency bump. No functional code changes detected.

Why this tier:

• Bot author: dependabot[bot]

Review process: Auto-merge once CI passes. No human review required.
SLA: Resolves automatically.

Stats

• Production files changed: 1
• Production lines changed: 2
• Branch: dependabot/npm_and_yarn/postcss-8.5.18
• Author: dependabot[bot]

To override this classification, remove the review/tier-1 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[github-actions]

E2E Test Results

✅ All tests passed • 242 passed • 1 skipped • 974s

Status	Count
✅ Passed	242
❌ Failed	0
⚠️ Flaky	1
⏭️ Skipped	1

Tests ran across 4 shards in parallel.

View full report →

[github-actions]

Deep Review

✅ No critical issues found. The bump is safe to merge — it introduces no regression, and CI does exercise the Webpack CSS pipeline on every PR, so a build-breaking change would be caught. One correctness caveat about what the bump actually accomplishes is worth a maintainer's attention.

🟡 P2 — recommended

• packages/app/package.json:142 — Raising the direct devDependency to ^8.5.18 does not change the postcss that processes the app's CSS, because yarn.lock:21791 pins next@16.2.11 to an exact postcss@8.4.31, so next build and next dev keep loading 8.4.31 and never pick up the 8.5.12/8.5.17/8.5.18 hardening this bump appears to deliver.

  • Fix: Add a root resolutions entry for postcss alongside the existing transitive pins if the hardening is meant to reach the build, then re-run the Webpack production build to confirm Next tolerates overriding its exact pin.
  • _{correctness, security, maintainability}

• package.json:70 — The root resolutions block is the repo's established mechanism for forcing patched transitive versions (express, cookie, brace-expansion, on-headers, fast-xml-parser, systeminformation), but postcss is absent from it, leaving three copies below the fix line: 8.4.31 at yarn.lock:23432, 8.4.38 at yarn.lock:23443, and 8.5.6 at yarn.lock:23465.

  • Fix: Decide explicitly whether postcss belongs in the resolutions convention and record the decision, rather than leaving the split to resolve implicitly on each bump.
  • _{security, maintainability}

---

Reviewers (5): correctness, security, testing, maintainability, project-standards.

Testing gaps:

• clickhouse-static-build runs yarn build:clickhouse and the e2e job builds via yarn build, so both exercise the real Webpack + postcss.config.cjs pipeline — a postcss change that throws would fail CI.
• No CSS-output or visual-regression check exists, so a silent change in processed CSS (for example Mantine breakpoint variable substitution) would pass unnoticed.
• lint:styles runs against stylelint's own postcss@8.5.6, so it provides no signal on the version this PR changes.
• Turbopack (next dev) is never exercised in CI, and packages/app/package.json:9 documents that the two bundlers can diverge on CSS Modules and loaders.

Coverage note: Bash failed on every call in this environment (bwrap: Can't create file at /home/.mcp.json), and Grep/Glob were unavailable, so the skill's git-based scope detection could not run. The diff scope was reconstructed from packages/app/package.json and yarn.lock via Read and cross-checked against the branch commit history; findings cite verified file/line evidence. Two always-on CE agents (agent-native, learnings-researcher) were not run — the former has no applicable surface in a dependency bump, the latter requires directory search over docs/solutions/. The untracked ce-plugin/ directory is out of review scope.