build(deps-dev): bump postcss and postcss-custom-properties

[dependabot]

Bumps postcss and postcss-custom-properties. These dependencies needed to be updated together.
Updates postcss from 8.5.15 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Commits

• 08c989c Release 8.5.25 version
• 24f6814 Fix 8.5.17 visitor regression
• f2fa53f Add supply chain security requirement to PostCSS plugin guide
• 10edf0b fix: return empty array for empty string in list.split (#2121)
• 0ebe8ad Release 8.5.24 version
• 73218c6 Update dependencies
• 9a114f6 Preserve the BOM when stringifying (#2119)
• 9069261 Fix types check
• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates postcss-custom-properties from 11.0.0 to 15.0.1

Changelog

Sourced from postcss-custom-properties's changelog.

15.0.1

February 21, 2026

• Fix importance of custom media in anonymous cascade layers.

15.0.0

January 14, 2026

• Updated: Support for Node 20.19.0 or later (major).
• Removed: commonjs API. In supported Node versions require(esm) will work without needing to make code changes.
• Updated @csstools/css-tokenizer to 4.0.0 (major)
• Updated @csstools/utilities to 3.0.0 (major)
• Updated @csstools/css-parser-algorithms to 4.0.0 (major)
• Updated @csstools/cascade-layer-name-parser to 3.0.0 (major)

14.0.6

June 5, 2025

• Fix infinite loop for comments that contain variables (e.g. var(--foo) /* var(--bar) */)

14.0.5

May 27, 2025

• Improve the implementation of how comments are preserved when transpiling
• Updated @csstools/css-tokenizer to 3.0.4 (patch)
• Updated @csstools/css-parser-algorithms to 3.0.5 (patch)
• Updated @csstools/cascade-layer-name-parser to 2.0.5 (patch)

14.0.4

November 1, 2024

• Updated @csstools/css-tokenizer to 3.0.3 (patch)
• Updated @csstools/css-parser-algorithms to 3.0.4 (patch)
• Updated @csstools/cascade-layer-name-parser to 2.0.4 (patch)

14.0.3

October 23, 2024

• Updated @csstools/css-parser-algorithms to 3.0.3 (patch)
• Updated @csstools/cascade-layer-name-parser to 2.0.3 (patch)

14.0.2

October 10, 2024

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by romainmenke, a new releaser for postcss-custom-properties since your current version.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontend-tools	Ready	Preview	Aug 5, 2026 11:25am