chore(deps): bump postcss and next by dependabot[bot] · Pull Request #4903 · DataBiosphere/data-browser

dependabot · 2026-08-05T07:47:56Z

Bumps postcss to 8.5.23 and updates ancestor dependency next. These dependencies need to be updated together.

Updates postcss from 8.4.31 to 8.5.23

Release notes

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates next from 16.2.9 to 16.3.1

Release notes

Sourced from next's releases.

v16.3.1

What's Changed

[16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in vercel/next.js#96653

[16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @lukesandberg in vercel/next.js#96655

[16.x] [turbopack] Collapse nested promises in the analyzer by @sampoder in vercel/next.js#96675

[16.x] fix(next/image): preserve image response after optimization by @styfle in vercel/next.js#96733

[16.3.x] Default deploy e2e tests to the repo next version by @eps1lon in vercel/next.js#96900

[backport] Bump @swc/helpers by @mischnic in vercel/next.js#96885

[backport] [turbopack] Raise registration calls in hoisted modules to the top by @lukesandberg in vercel/next.js#97308

[backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @lukesandberg in vercel/next.js#97302

[backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @lukesandberg in vercel/next.js#97317

[backport] Restore the live headers() view of the incoming request by @unstubbable in vercel/next.js#97311

[backport] Allow literal exports in 'use cache' files by @unstubbable in vercel/next.js#97312

[backport] Keep the dev validation worker alive across HMR updates by @unstubbable in vercel/next.js#97315

[backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @unstubbable in vercel/next.js#97314

[backport] Encode the cache item name built by unstable_cache by @unstubbable in vercel/next.js#97313

[16.3] [ci] Use OIDC tokens to read private preview builds by @eps1lon in vercel/next.js#97258

[backport] [test] Compile the middleware redirect routes up front in dev by @lukesandberg in vercel/next.js#97328

[backport] Fix Nav Inspector request loop on repeat captures by @acdlite in vercel/next.js#97326

[backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @acdlite in vercel/next.js#97325

[backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @lukesandberg in vercel/next.js#97304

[backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.25

Misc Changes

[PPF] Remove unstable_eager: #97524

[PPF] Do not mark complete shell requests as partial: #97503

fix: add accessible label to icon-only link: #96334

Fix stale cross-references in skills/: #97566

docs: generateMetadata values should be serializable with use cache: #97551

Move preview props into separate manifest: #96004

docs: adjust interactive app guide: #97558

Turbopack: allow TURBOPACK_PRINT_CHUNK_GROUPS in release builds: #97515

[test] Point next-image-legacy images at a reachable endpoint: #97545

test: improve error-on-next-codemod-comment flakiness: #97553

Turbopack: cross-module constants: #90300

test: better isolate concurrent-install suite: #97546

docs: outlining and lcp: #96942

Fix use cache prerender signal retention: #97476

Turbopack: More aggressively debounce filesystem watch events if we detected changes to node_modules: #96116

docs: document metadata pagination field: #95509

Credits

Huge thanks to @lubieowoce, @niketchandivade, @gaojude, @devjiwonchoi, @mischnic, @aurorascharff, @eps1lon, @icyJoseph, @gnoff, @bgw, and @biubiukam for helping!

... (truncated)

Commits

3d32eb8 v16.3.1
2b4b1ec [backport] Revert i18n localization change for dynamic Pages API routes (#949...
228df5f [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fa...
16eab3a [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops (#...
75548c9 [backport] Fix Nav Inspector request loop on repeat captures (#97326)
f6bd714 [backport] [test] Compile the middleware redirect routes up front in dev (#97...
43c1c60 [16.3] [ci] Use OIDC tokens to read private preview builds (#97258)
9dbb357 [backport] Encode the cache item name built by unstable_cache (#97313)
323a17c [backport] Discard only cache entries that predate a tag revalidation, and re...
6d67f46 [backport] Keep the dev validation worker alive across HMR updates (#97315)
Additional commits viewable in compare view

Bumps [postcss](https://github.com/postcss/postcss) to 8.5.23 and updates ancestor dependency [next](https://github.com/vercel/next.js). These dependencies need to be updated together. Updates `postcss` from 8.4.31 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.23) Updates `next` from 16.2.9 to 16.3.1 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.9...v16.3.1) --- updated-dependencies: - dependency-name: next dependency-version: 16.3.0 dependency-type: direct:production - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies [subject] External software packages that the system depends on javascript Pull requests that update javascript code labels Aug 5, 2026

dependabot Bot mentioned this pull request Aug 5, 2026

chore(deps): bump next from 16.2.9 to 16.2.12 #4901

Closed

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-4b10dec7ea branch from 18c39f2 to 11f15d3 Compare August 20, 2026 03:53

Navigation Menu

Uh oh!

chore(deps): bump postcss and next - #4903

chore(deps): bump postcss and next#4903
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-4b10dec7ea

dependabot Bot commented on behalf of github Aug 5, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

v16.3.1

What's Changed

v16.3.1-canary.25

Misc Changes

Credits

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 5, 2026 •

edited

Loading