[dependabot]

Bumps postcss from 8.5.26 to 8.5.32.

Release notes

Sourced from postcss's releases.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

Changelog

Sourced from postcss's changelog.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

Commits

• 2455ac8 Release 8.5.32 version
• e367106 Update dependencies
• f70f586 Fix Input#origin() without from or with relative sourceRoot (#2179)
• eb28619 Fix final-word lookup without source offsets (#2178)
• 095654b Preserve explicit start in Warning#toString() (#2177)
• 9b3d8b8 Preserve Promise semantics in result finally() (#2176)
• d190857 Release 8.5.31 version
• 4ef6d8c Update dependencies
• 6abd674 Call the builder with every node when the output is escaped (#2175)
• f1aca7e Release 8.5.30 version
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

🔍 Dependency Analysis Summary

Package	Change	Type	Scope
postcss	8.5.26 → 8.5.32	Patch	components/chat_widget devDependency (build-time only)
nanoid (transitive via postcss)	3.3.18 → 3.3.20	Patch	build-time only
source-map-js (transitive)	1.2.1 → deduplicated onto the existing 1.2.2	Patch	build-time only

Only components/chat_widget/pnpm-lock.yaml changes. The package.json specifier (^8.5.22) stays the same.

Overall risk: LOW

📋 Detailed Changelog Review

postcss 8.5.26 → 8.5.32. These are all bug fixes, with no new APIs and no breaking changes:

• 8.5.27: Comments starting with /*# are no longer removed. Fixes for * hack before comments in custom properties, empty or whitespace-only values in list.comma() / list.space(), a rule's end position when there is a space before ;, and types.
• 8.5.28: Fixes a types regression from 8.5.27.
• 8.5.29: Better </style> escaping, comment support in list.comma() / list.space(), and a fix for semicolons in custom properties.
• 8.5.30 / 8.5.31: Source map fixes for </style> escaping.
• 8.5.32: Fixes Input#origin() without opts.from, the final-word lookup without source offsets, an explicit start in Warning#toString(), and LazyResult#finally() Promise semantics.
• Security: No advisories are listed. The </style> escaping change hardens output that is inlined into <style> tags, which is a minor improvement.
• Migration: None needed.

nanoid 3.3.20 / source-map-js 1.2.2: These are patch-level transitive bumps. The lockfile now resolves a single source-map-js version instead of two.

⚠️ Impact Assessment

• Breaking changes found: No.
• Where OCS uses postcss: Only in components/chat_widget/stencil.config.ts, inside the tailwindComponentStyles() Stencil plugin. It calls postcss([tailwind]).process(..., { from: file, map: false }) and reads result.css and result.messages.
  • It sets map: false, so the source map fixes in 8.5.30 and 8.5.31 don't apply.
  • It always passes from, so the Input#origin() fix in 8.5.32 doesn't apply.
  • The /** @prop */ doc comments are taken from the original source with a regex, not from the PostCSS output, so the comment-handling changes in 8.5.27 and 8.5.29 can't drop them.
  • Custom-property parsing fixes could change minified CSS byte-for-byte, but only in edge cases (a * hack or ; inside custom property values).
• Affected files: None need changes.
• Test impact: None expected. Jest specs don't run postcss.
• Configuration changes: None.
• Runtime impact: None on the Django app or assets/. The root project doesn't use this lockfile.

🛠️ Recommendations

• Action required: None.
• Testing focus: I installed the lockfile with pnpm install --frozen-lockfile and it resolved postcss 8.5.32 cleanly. I could not run stencil build --docs in this environment, so CI's widget build is the check to rely on. Optionally, confirm that the generated src/components/**/readme.md files show no diff and that the widget looks the same in the browser.
• Follow-up tasks: None.
• Merge recommendation: APPROVE, once CI passes.

📚 Useful Links

• Releases: https://github.com/postcss/postcss/releases
• Changelog: https://github.com/postcss/postcss/blob/main/CHANGELOG.md
• Compare: postcss/postcss@8.5.26...8.5.32

[ocs-percy]

Approving at 53a9ff1: chore(deps-dev): bump postcss from 8.5.26 to 8.5.32 in /components/chat_widget.

Changes: components/chat_widget/pnpm-lock.yaml (+11 -17). The automated review rated it low risk. All 6 CI checks on this exact head pass. A fresh merge simulation is not needed beyond what GitHub reports: the PR is mergeable.

Not done: manual smoke tests. I am relying on CI, the diff and the review.