chore(deps): bump postcss, css-loader, stylelint and stylelint-webpack-plugin

[dependabot]

Bumps postcss to 8.5.12 and updates ancestor dependencies postcss, css-loader, stylelint and stylelint-webpack-plugin. These dependencies need to be updated together.

Updates postcss from 6.0.23 to 8.5.12

Release notes

Sourced from postcss's releases.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

8.5.8

• Fixed Processor#version.

8.5.7

• Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

• Fixed ContainerWithChildren type discriminating (by @​Goodwine).

8.5.5

• Fixed package.json→exports compatibility with some tools (by @​JounQin).

8.5.4

• Fixed Parcel compatibility issue (by @​git-sumitchaudhary).

8.5.3

• Added more details to Unknown word error (by @​hiepxanh).
• Fixed types (by @​romainmenke).
• Fixed docs (by @​catnipan).

8.5.2

• Fixed end position of rules with semicolon (by @​romainmenke).

8.5.1

• Fixed backwards compatibility for complex cases (by @​romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@​romainmenke during his work on Stylelint added Input#document in additional to Input#css.

root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
</tr></table> 

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

8.5.8

• Fixed Processor#version.

8.5.7

• Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

• Fixed ContainerWithChildren type discriminating (by @​Goodwine).

8.5.5

• Fixed package.json→exports compatibility with some tools (by @​JounQin).

8.5.4

• Fixed Parcel compatibility issue (by @​git-sumitchaudhary).

8.5.3

• Added more details to Unknown word error (by @​hiepxanh).
• Fixed types (by @​romainmenke).
• Fixed docs (by @​catnipan).

8.5.2

• Fixed end position of rules with semicolon (by @​romainmenke).

8.5.1

• Fixed backwards compatibility for complex cases (by @​romainmenke).

... (truncated)

Commits

• 9bc81c4 Release 8.5.12 version
• 85c4d7d Another try to fix coverage
• 94484ca Try to fix coverage
• c64b748 Load only .map source maps
• aaec7b7 Avoid throwing JSON parsing errors for non-JSON source maps
• 233fb26 Mention original author of the solution
• 2502f75 Release 8.5.11 version
• 5ca1901 Speed up parsing many nested brackets
• 42b5337 Update dependencies
• 7e36e15 Cache node.raws locally in Stringifier hot methods
• Additional commits viewable in compare view

Updates css-loader from 1.0.0 to 7.1.4

Release notes

Sourced from css-loader's releases.

v7.1.4

7.1.4 (2026-02-16)

Bug Fixes

• update peer dependency for @​rspack/core v2 (#1652) (aeddefe)

v7.1.3

7.1.3 (2026-01-27)

Bug Fixes

• allow to use module class name (#1649) (01869bc)
• use official createHash for hashes (#1618) (06587e5)
• use official hash* options for hashes (#1619) (9544c3e)

v7.1.2

7.1.2 (2024-05-22)

Bug Fixes

• keep order of @imports with the webpackIgnore comment (#1600) (76757ef)

v7.1.1

7.1.1 (2024-04-10)

Bug Fixes

• automatically rename class default to _default when named export is enabled (#1590) (d6c31a1)

v7.1.0

7.1.0 (2024-04-08)

Features

• added the getJSON option to output CSS modules mapping (#1577) (af834b4)

v7.0.0

7.0.0 (2024-04-04)

⚠ BREAKING CHANGES

• The modules.namedExport option is true by default if you enable the esModule option

... (truncated)

Changelog

Sourced from css-loader's changelog.

7.1.4 (2026-02-16)

Bug Fixes

• update peer dependency for @​rspack/core v2 (#1652) (aeddefe)

7.1.3 (2026-01-27)

Bug Fixes

• allow to use module class name (#1649) (01869bc)
• use official createHash for hashes (#1618) (06587e5)
• use official hash* options for hashes (#1619) (9544c3e)

7.1.2 (2024-05-22)

Bug Fixes

• keep order of @imports with the webpackIgnore comment (#1600) (76757ef)

7.1.1 (2024-04-10)

Bug Fixes

• automatically rename class default to _default when named export is enabled (#1590) (d6c31a1)

7.1.0 (2024-04-08)

Features

• added the getJSON option to output CSS modules mapping (#1577) (af834b4)

7.0.0 (2024-04-04)

⚠ BREAKING CHANGES

• The modules.namedExport option is true by default if you enable the esModule option

Migration guide:

Before:

import style from "./style.css";
</tr></table> 

... (truncated)

Commits

• 5b795af chore(release): 7.1.4
• aeddefe fix: update peer dependency for @​rspack/core v2 (#1652)
• b2b2de7 chore(release): 7.1.3
• 01869bc fix: allow to use module class name (#1649)
• 7dd15ec chore(deps): bump js-yaml (#1648)
• db26202 chore(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#1647)
• 7daf1b8 Update CONTRIBUTING link to point to GitHub page
• de1e633 chore: correct link path (#1645)
• 563ad63 chore: migrate from contrib and swap branches (#1644)
• e68bf7e chore: update github actions/checkout from v4 to v5 (#1642)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates stylelint from 8.4.0 to 17.9.0

Release notes

Sourced from stylelint's releases.

17.9.0

It adds 3 new features. Adding the referenceFiles property to your configuration object makes the no-unknown-animations, no-unknown-custom-media and no-unknown-custom-properties rules more useful.

• Added: experimental referenceFiles to configuration object (#9179) (@​jeddy3).
• Added: experimental abortSignal option to Node.js API for cancellation support (#9213) (@​adalinesimonian).
• Added: maxWarnings to configuration object (#9181) (@​mrginglymus).

17.8.0

It adds 3 new rules and 1 configuration property.

• Added: languageOptions.directionality configuration property (#8687) (@​sw1tch3roo).
• Added: property-layout-mappings rule (#8687) (@​sw1tch3roo).
• Added: relative-selector-nesting-notation rule (#8730) (@​sw1tch3roo).
• Added: selector-no-deprecated rule (#8694) (@​immitsu).

17.7.0

It fixes 4 bugs, including clearer problem messages by removing filler words and leading with the problem. We've also released 1.0.0 of create-stylelint to help with first-time Stylelint setup.

• Fixed: clarity of problem messages (#9199) (@​jeddy3).
• Fixed: --print-config CLI flag to hide internal properties (#9194) (@​ybiquitous).
• Fixed: function-url-quotes false positives when URLs have modifiers (#8702) (@​immitsu).
• Fixed: selector-no-qualifying-type false positives for :has() (#9182) (@​romainmenke).

17.6.0

It adds support for extending units in languageOptions, which then apply to rules like declaration-property-value-no-unknown, and fixes 2 bugs.

• Added: support for extending units to languageOptions (#9166) (@​jeddy3).
• Fixed: missing ruleMetadata when linting multiple files with overrides (#9154) (@​kovsu).
• Fixed: custom-property-no-missing-var-function false positives for timeline-scope and animation-timeline (#9164) (@​splincode).

17.5.0

It deprecates two rule options, adds 1 rule option and fixes 7 bugs. We've also released 2.1.0 of our VS Code extension, which adds 8 new requested features, and our first release of the Stylelint Language Server.

• Deprecated: *syntax options from declaration-property-value-no-unknown (#9102) (@​ragini-pandey).
• Added: ignoreMediaFeatureNameValues: {} to media-feature-name-value-no-unknown (#8976) (@​kovsu).
• Fixed: node_modules not ignored when using codeFilename in Node.js API (#9130) (@​adalinesimonian).
• Fixed: Error TS7016 for imported css-tree types (#9133) (@​ragini-pandey).
• Fixed: declaration-property-value-keyword-no-deprecated false positives for function arguments (#9116) (@​ragini-pandey).
• Fixed: declaration-property-value-no-unknown false positives for calc-size() containing size keyword (#9105) (@​hriztam).
• Fixed: no-descending-specificity & no-duplicate-selectors false negatives for equivalent compound selectors (#8977) (@​kovsu).
• Fixed: no-invalid-position-declaration false positives for @mixin and @scope (#9120) (@​ragini-pandey).
• Fixed: property-no-unknown false negatives for types (#9117) (@​Mouvedia).

17.4.0

It adds 2 options to the rules and fixes 7 bugs.

• Added: ignoreAtRules: [] to at-rule-no-vendor-prefix (#9096) (@​theacrat).
• Added: ignoreMediaFeatureNames: [] to media-feature-name-no-vendor-prefix (#9097) (@​theacrat).
• Fixed: performance of selector cloning rules (#9089) (@​jeddy3).
• Fixed: *-empty-line-before performance (#9092) (@​jeddy3).

... (truncated)

Changelog

Sourced from stylelint's changelog.

17.9.0 - 2026-04-23

It adds 3 new features. Adding the referenceFiles property to your configuration object makes the no-unknown-animations, no-unknown-custom-media and no-unknown-custom-properties rules more useful.

• Added: experimental referenceFiles to configuration object (#9179) (@​jeddy3).
• Added: experimental abortSignal option to Node.js API for cancellation support (#9213) (@​adalinesimonian).
• Added: maxWarnings to configuration object (#9181) (@​mrginglymus).

17.8.0 - 2026-04-15

It adds 3 new rules and 1 configuration property.

• Added: languageOptions.directionality configuration property (#8687) (@​sw1tch3roo).
• Added: property-layout-mappings rule (#8687) (@​sw1tch3roo).
• Added: relative-selector-nesting-notation rule (#8730) (@​sw1tch3roo).
• Added: selector-no-deprecated rule (#8694) (@​immitsu).

17.7.0 - 2026-04-12

It fixes 4 bugs, including clearer problem messages by removing filler words and leading with the problem. We've also released 1.0.0 of create-stylelint to help with first-time Stylelint setup.

• Fixed: clarity of problem messages (#9199) (@​jeddy3).
• Fixed: --print-config CLI flag to hide internal properties (#9194) (@​ybiquitous).
• Fixed: function-url-quotes false positives when URLs have modifiers (#8702) (@​immitsu).
• Fixed: selector-no-qualifying-type false positives for :has() (#9182) (@​romainmenke).

17.6.0 - 2026-03-26

It adds support for extending units in languageOptions, which then apply to rules like declaration-property-value-no-unknown, and fixes 2 bugs.

• Added: support for extending units to languageOptions (#9166) (@​jeddy3).
• Fixed: missing ruleMetadata when linting multiple files with overrides (#9154) (@​kovsu).
• Fixed: custom-property-no-missing-var-function false positives for timeline-scope and animation-timeline (#9164) (@​splincode).

17.5.0 - 2026-03-19

It deprecates two rule options, adds 1 rule option and fixes 7 bugs. We've also released 2.1.0 of our VS Code extension, which adds 8 new requested features, and our first release of the Stylelint Language Server.

• Deprecated: *syntax options from declaration-property-value-no-unknown (#9102) (@​ragini-pandey).
• Added: ignoreMediaFeatureNameValues: {} to media-feature-name-value-no-unknown (#8976) (@​kovsu).
• Fixed: node_modules not ignored when using codeFilename in Node.js API (#9130) (@​adalinesimonian).
• Fixed: Error TS7016 for imported css-tree types (#9133) (@​ragini-pandey).
• Fixed: declaration-property-value-keyword-no-deprecated false positives for function arguments (#9116) (@​ragini-pandey).
• Fixed: declaration-property-value-no-unknown false positives for calc-size() containing size keyword (#9105) (@​hriztam).
• Fixed: no-descending-specificity & no-duplicate-selectors false negatives for equivalent compound selectors (#8977) (@​kovsu).
• Fixed: no-invalid-position-declaration false positives for @mixin and @scope (#9120) (@​ragini-pandey).
• Fixed: property-no-unknown false negatives for types (#9117) (@​Mouvedia).

17.4.0 - 2026-02-25

... (truncated)

Commits

• cee404b Release 17.9.0 (#9242)
• b0af5ae Bump prettier from 3.8.1 to 3.8.3 (#9240)
• e2c2c43 Bump eslint-plugin-jest from 29.15.1 to 29.15.2 in the eslint group (#9239)
• 68d008e Bump @​csstools/css-syntax-patches-for-csstree from 1.1.2 to 1.1.3 in the csst...
• 5ad7ffb Bump @​csstools/css-calc from 3.1.1 to 3.2.0 in the csstools-parser group (#9237)
• f16ef5e Bump actions/upload-artifact from 7.0.0 to 7.0.1 (#9235)
• a0b3c5a Bump actions/github-script from 8.0.0 to 9.0.0 (#9236)
• fb2efec Add abortSignal option to Node.js API for cancellation support (#9213)
• 84f2c6b Document Netlify hosting badge (#9218)
• 5b45245 Add maxWarnings to configuration object (#9181)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for stylelint since your current version.

Install script changes

This version adds prepare, postprepare scripts that run during installation. Review the package contents before updating.

Updates stylelint-webpack-plugin from 0.10.5 to 5.1.0

Release notes

Sourced from stylelint-webpack-plugin's releases.

v5.1.0

5.1.0 (2026-02-04)

Features

• add stylelint v17 support (#377) (27d4787), closes #376

v5.0.1

5.0.1 (2024-05-24)

Bug Fixes

• output report generation (#355) (d5d4ac1)

v5.0.0

5.0.0 (2024-02-02)

⚠ BREAKING CHANGES

• minimum supported Node.js version is 18 (#345)

Features

• support stylelint v16 (#346) (a40857c)

build

• minimum supported Node.js version is 18 (#345) (1ee4588)

v4.1.1

4.1.1 (2023-04-10)

Performance

• enable cache by default (#327)

v4.1.0

4.1.0 (2023-02-18)

Features

• add stylelint v15 (#323) (8dc5881)

v4.0.0

4.0.0 (2023-02-02)

... (truncated)

Changelog

Sourced from stylelint-webpack-plugin's changelog.

5.1.0 (2026-02-04)

Bug Fixes

• fix: remove skipLibCheck

• fix: upgrade stylelint version

• fix: npm audit

• refactor: coverage and dead code

• ci: add stylelint 17.x

Features

• add stylelint v17 support (#377) (27d4787), closes #376

5.0.1 (2024-05-24)

Bug Fixes

• output report generation (#355) (d5d4ac1)

5.0.0 (2024-02-02)

⚠ BREAKING CHANGES

• minimum supported Node.js version is 18 (#345)

Features

• support stylelint v16 (#346) (a40857c)

build

• minimum supported Node.js version is 18 (#345) (1ee4588)

4.1.1 (2023-04-10)

Performance

• enable cache by default (#327)

4.1.0 (2023-02-18)

... (truncated)

Commits

• ec9f72a chore(release): 5.1.0
• ac6e4e2 refactor: do not force the use of node 20, it is only mandatory in stylelint ...
• 27d4787 feat: add stylelint v17 support (#377)
• 4cc8128 docs: update contributing
• 3d150ec chore: migrate from contrib (#375)
• e685b20 chore: update github actions/checkout from v4 to v5 (#374)
• 0115aea refactor: restore old logic
• ceea2d6 chore(deps): remove unused
• 3d7d7d3 chore: migrate to eslint version 9 (#371)
• 9a062d9 chore: downgrade jest-worker dependency (#370)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ricardogobbosouza, a new releaser for stylelint-webpack-plugin since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.