refactor: Bump postcss from 8.5.19 to 8.5.28 and css-loader from 7.1.4 to 7.1.5

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #3435

Bumps the transitive dev dependency postcss from 8.5.19 to 8.5.28 to fix the Dependabot security alert GHSA-fxqj-rqcc-2cmp (medium, vulnerable <= 8.5.22, patched in 8.5.23). It also bumps the direct dev dependency css-loader from 7.1.4 to 7.1.5, which is needed to keep the production CSS output unchanged with the new postcss (see below).

Approach

This supersedes the bot target (8.5.26) with 8.5.28, the latest version in range, which npm update postcss resolves.

Lock file changes: postcss 8.5.19 → 8.5.28, its dependency nanoid 3.3.16 → 3.3.19, and css-loader 7.1.4 → 7.1.5. In package.json, only the css-loader devDependency changes, pinned to 7.1.5.

Changes

postcss

• 8.5.20: Fixed missing space if AtRule#params is set after; fixed mixing AST error on warnings.
• 8.5.21: Fixed childless at-rule losing semicolon before comment.
• 8.5.22: Fixed custom property losing semicolon before a comment.
• 8.5.23: Do not load source map without opts.from for security reasons (fixes GHSA-fxqj-rqcc-2cmp).
• 8.5.24: Preserve the BOM after the processing (Preserve the BOM when stringifying postcss/postcss#2119).
• 8.5.25: Fixed 8.5.17 visitor regression; fixed list.split() for non-string values.
• 8.5.26: Fixed list.split() regression; track symlinks in path protection in source map loading.
• 8.5.27: Fixed removing any comments starting with /*#; fixed * hack before a comment in custom properties; fixed empty values in list.comma() and whitespace-only values in list.space(); fixed rule end position on space before semicolon; fixed types.
• 8.5.28: Fixed types regression.

css-loader

• 7.1.5: Strip BOM before processing with postcss (fix: strip BOM before processing with postcss webpack/css-loader#1684).

Why css-loader 7.1.5 is included

Before 8.5.24, postcss removed a leading byte order mark (U+FEFF) from its output. Since 8.5.24 it keeps the BOM if the input had one. In production builds (production.config.js, publish.config.js), sass-loader compiles in compressed style. Dart Sass then adds a BOM to any stylesheet whose output contains non-ASCII characters. Two stylesheets here have such characters: ScrollHint.scss (content: '╲╱') and BrowserMenu.scss (content: '›').

With css-loader 7.1.4, their CSS strings in the bundle start with . style-loader injects each module as a <style> element, and the browser reads the BOM as part of the first selector. That first rule then never matches: the scroll hint arrow and BrowserMenu's .wrap { display: inline-block }. The same issue was reported to postcss in postcss/postcss#2133, and css-loader 7.1.5 fixes it by stripping the BOM before calling postcss.

Local production build check. CI does not cover this: the webpack build succeeds either way, and the problem only appears in the browser at runtime. I ran npm ci and npm run build locally and searched the emitted bundles:

• css-loader 7.1.5 + postcss 8.5.28 (this PR): no BOM in any CSS string. The ScrollHint and BrowserMenu CSS strings start directly with their selectors.
• Control, css-loader 7.1.4 + postcss 8.5.28: both CSS strings start with .

The 8.5.23 source map change does not affect the build, because css-loader always passes from and provides the previous map explicitly.

Breaking Changes

None

Code Changes Required

None. Only package.json and package-lock.json change.

Tasks

No tasks apply; this PR only changes the manifest and lock file.

Summary by CodeRabbit

• Chores
  • Updated underlying styling and build-tool packages.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 396bd251-5090-4a86-896b-e49fe92d384b

📥 Commits

Reviewing files that changed from the base of the PR and between 89cd816 and bdcb043.

📒 Files selected for processing (2)

• package-lock.json
• package.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The dependency manifest and lockfile update css-loader from 7.1.4 to 7.1.5, nanoid from 3.3.16 to 3.3.19, and postcss from 8.5.19 to 8.5.28. The locked nanoid requirement for postcss changes to ^3.3.18.

Changes

Dependency updates

Layer / File(s)	Summary
Dependency declarations and lockfile package.json, package-lock.json	The manifest updates the css-loader devDependency. The lockfile updates package versions, resolved URLs, and integrity hashes for css-loader, nanoid, and postcss, and changes the postcss requirement for nanoid.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Merge Risk: ⚪ Minimal · up to bdcb0

The updated dependencies address the reported CSS BOM behavior, and no concrete merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title starts with the allowed prefix refactor: and uses a capitalized first word. It accurately describes the dependency updates.
Description check	✅ Passed	The description includes all required sections and clearly explains the issue, approach, dependency changes, validation, and task status.
Linked Issues check	✅ Passed	Issue [#3435] requires the PostCSS dependency update from 8.5.19 to at least 8.5.26. The PR summary records postcss at 8.5.28 in package-lock.json, which exceeds the requested target. The lockfile…
Out of Scope Changes check	✅ Passed	The changes remain within the dependency-update scope of [#3435]. The css-loader update supports the reported BOM behavior caused by the PostCSS update. The nanoid lockfile update is a transitive …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check	✅ Passed	PASS. The PR changes only package manifests and lock metadata; it adds no executable code or new security-sensitive pattern. The authoritative diff updates css-loader 7.1.4→7.1.5, postcss 8.5.19→8…
Engage In Review Feedback	✅ Passed	The current review produced zero actionable findings, and no CodeRabbit review threads were returned. Therefore, no review feedback was ignored or resolved without engagement.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[parseplatformorg]

🎉 This change has been released in version 9.3.0-alpha.9