chore(deps): bump postcss from 8.4.31 to 8.5.23 in /site in the npm_and_yarn group across 0 directory

[dependabot]

Updates postcss from 8.4.31 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

... (truncated)

Commits

• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​15.5.24 ⏵ 16.3.5	-3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm next Location: Package overview From: site/package.json → npm/next@16.3.5 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.3.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[kaankacar]

🤖 Automated message from Kaan's Automated Triage Bot.

👀 Picked this up — a review will follow shortly.

[Copilot]

Pull request overview

This PR updates PostCSS but also introduces an unrelated Next.js 15-to-16 upgrade.

Changes:

• Bumps PostCSS from 8.4.31 to 8.5.23.
• Updates Next.js to 16.3.5 and related dependencies.
• Leaves unresolved peer and lint-script compatibility issues.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Summary
site/pnpm-lock.yaml	Updates PostCSS and locks @next/third-parties@15.5.18 with Next.js 16.3.5, causing a peer mismatch (moderate, 3 votes).
site/package.json	Upgrades Next.js and retains the removed next lint command, breaking lint CI (critical, 3 votes).

Files not reviewed (1)

• site/pnpm-lock.yaml: Generated file

Suppressed comments (1)

site/package.json:24

• This line changes the direct Next dependency from 15.5.24 to the unrelated major version 16.3.5, while this PR is only supposed to update PostCSS. The lockfile consequently replaces the entire Next 15/SWC dependency set, introducing a framework upgrade and its breaking changes; please restore Next 15.5.24 and regenerate the lockfile so only the PostCSS resolution changes.

    "next": "16.3.5",

Note

Copilot is running an experiment and ran this review at Lite.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kaankacar]

🤖 Automated message from Kaan's Automated Triage Bot.

Thanks Dependabot. Flagging a mismatch: the title says postcss 8.4.31 to 8.5.23, but the diff is a Next.js major upgrade, next 15.5.24 to 16.3.5. postcss moves only as a transitive dependency of next.

I did not merge. Two blockers at this head:

• Next 16 removed the next lint command. site/package.json still has "lint": "next lint". The preview check failed on exactly this. I confirmed the removal: dist/cli/next-lint.js ships in next@15.5.24 and is absent in next@16.3.5.
• @next/third-parties stays at ^15.5.7. The locked 15.5.18 declares next: ^13 || ^14 || ^15, so 16.3.5 does not satisfy its peer range.

Copilot raised both points. I verified both and agree.

There is also no build evidence for Next 16. The run stopped at lint, so lint:ts, build and the ecosystem-link checks were all skipped. Socket separately flagged a High license policy violation on next@16.3.5.

@kaankacar this needs your decision. The postcss advisories are real: GHSA-6g55-p6wh-862q, GHSA-r28c-9q8g-f849 and GHSA-fxqj-rqcc-2cmp, all fixed in 8.5.23. Two paths:

1. Do the Next 16 upgrade deliberately, in its own PR. It also needs @next/third-parties and eslint-config-next at 16, plus an ESLint flat config, because the site still uses .eslintrc.json and eslint 9 defaults to flat config.
2. Keep Next 15 and pin postcss through a pnpm.overrides entry. postcss has a single dependent in the lockfile, so this clears all three advisories with no framework change.

I left the PR open for you.

[ranimandira18-hash]

skills-digests.txt