Pull request #30 · stacks/ts-css

This PR contains the following updates:

🔒 Security Advisories

This PR resolves 4 known vulnerabilities across 1 package.

Package	Severity	Advisory	Fixed in	Summary
`postcss`	🟠 High	GHSA-6g55-p6wh-862q (CVE-2026-45623)	`8.5.12`	PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
`postcss`	🟠 High	GHSA-r28c-9q8g-f849 (CVE-2026-73646)	`8.5.18`	PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
`postcss`	🟡 Moderate	GHSA-fxqj-rqcc-2cmp (CVE-2026-69153)	`8.5.23`	PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
`postcss`	🟡 Moderate	GHSA-qx2v-qp2m-jg93 (CVE-2026-41305)	`8.5.10`	PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Package	Change	Age	Adoption	Passing	Confidence
postcss (source)	`8.5.6` -> `8.5.32`

Release Notes

postcss/postcss (postcss)

8.5.6 -> 8.5.32

`8.5.32`

Compare Source

Fixed Input#origin() without opts.from (by wleeaf).
Fixed final-word lookup without source offsets (by Don-Yin).
Fixed explicit start in Warning#toString() (by Don-Yin).
Fixed Promise semantics in LazyResult#finally() (by Don-Yin).

Released by github-actions[bot] on 10/26/2026

`8.5.31`

Compare Source

Fix better source map on </style> escaping (by firefoxic).

Released by github-actions[bot] on 10/18/2026

`8.5.30`

Compare Source

Fix broken map on </style> escaping (by Rufflet).

Released by github-actions[bot] on 10/12/2026

📊 Package Statistics

postcss: 255,207,130 weekly downloads

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Buddy 🤖

{"schemaVersion":1,"updates":[{"name":"postcss","current":"8.5.6","target":"8.5.32","type":"patch","file":"benchmark/package.json","dependencyType":"dependencies"}],"group":"Security Updates","generatedAt":"2026-10-26T23:43:16.864Z"} -->