Upgrade: [dependabot] - bump postcss and styled-components by dependabot[bot] · Pull Request #4622 · NHSDigital/electronic-prescription-service-api

dependabot · 2026-04-25T10:07:45Z

Bumps postcss to 8.5.10 and updates ancestor dependency styled-components. These dependencies need to be updated together.

Updates postcss from 8.4.49 to 8.5.10

Release notes

Sourced from postcss's releases.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@romainmenke during his work on Stylelint added Input#document in additional to Input#css.
root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"
</tr></table>

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

Added Input#document for sources like CSS-in-JS or HTML (by @romainmenke).

Commits

33b9790 Release 8.5.10 version
536c79e Escape </style> in CSS output (#2074)
afa96b2 Update dependencies (#2073)
effe88b Typo (#2072)
3ee79a2 Thread model (#2071)
2e0683d Create incident response docs (#2070)
fe88ac2 Release 8.5.9 version
c551632 Avoid RegExp when we can use simple JS
89a6b74 Move SECURITY.txt for docs folder to keep GitHub page cleaner
6ceb8a4 Create SECURITY.md
Additional commits viewable in compare view

Updates styled-components from 6.3.11 to 6.4.1

Release notes

Sourced from styled-components's releases.

styled-components@6.4.1

Patch Changes

49d09ae: Fix a performance regression in 6.4.0 where dynamic createGlobalStyle components caused significant re-render slowdowns. Also restores pre-6.4 cascade ordering when multiple instances of the same createGlobalStyle coexist.

eca95b2: Fix outdated dev-mode error messages for keyframes-in-untagged-strings and component-selector references that still pointed at www.styled-components.com and described behavior from styled-components v3.

styled-components@6.4.1-prerelease-20260417184545

Full Changelog: https://github.com/styled-components/styled-components/compare/styled-components@6.4.1-prerelease-20260417184031...styled-components@6.4.1-prerelease-20260417184545

styled-components@6.4.1-prerelease-20260417184031

What's Changed

fix: avoid double rebuildGroup on every dynamic createGlobalStyle render (#5730) by @quantizor in styled-components/styled-components#5732

Full Changelog: https://github.com/styled-components/styled-components/compare/styled-components@6.4.0...styled-components@6.4.1-prerelease-20260417184031

styled-components@6.4.0

Minor Changes
b0f3d29: .attrs() improvements: props supplied via attrs are now automatically made optional on the resulting component (previously required even when attrs provided a default). Also fixes a bug where the attrs callback received a mutable props object that could be changed by subsequent attrs processing; it now receives an immutable snapshot.

2a973d8: Dropped IE11 support: ES2015 build target, inlined unitless CSS properties (removing @emotion/unitless dependency), removed legacy React class statics from hoist and other unnecessary code.
9e07d95: Add createTheme(defaultTheme, options?) for CSS variable theming that works across RSC and client components.

Returns an object with the same shape where every leaf is var(--prefix-path, fallback). Pass it to ThemeProvider for stable class name hashes across themes (no hydration mismatch on light/dark switch).
const theme = createTheme({ colors: { primary: '#0070f3' } });
// theme.colors.primary → "var(--sc-colors-primary, #0070f3)"
// theme.raw → original object
// theme.vars.colors.primary → "--sc-colors-primary"
// theme.resolve(el?) → computed values from DOM (client-only)
// theme.GlobalStyle → component that emits CSS var declarations
vars exposes bare CSS custom property names (same shape as the theme) for use in createGlobalStyle dark mode overrides without hand-writing variable names:
const { vars } = createTheme({ colors: { bg: '#fff', text: '[#000](https://github.com/styled-components/styled-components/issues/000)' } });
const DarkOverrides = createGlobalStyle@media (prefers-color-scheme: dark) { :root { ${vars.colors.bg}: [#111](https://github.com/styled-components/styled-components/issues/111); ${vars.colors.text}: #eee; } };

... (truncated)

Commits

37a0a5e Version Packages
2f1a3fb ci: per-package prerelease notes with progression link [skip ci]
fea4919 ci: match prerelease notes to release job format [skip ci]
e557e11 style: align prerelease job formatting with release job
a3dee6d ci: collapse prerelease workflow into release.yml
52bda0c chore: add husky pre-commit hook running prettier
eca95b2 chore: add changeset for stale error message fix
c8db03c fix(build): emit errors.ts from generator so compiled bundle matches errors.md
45e4b84 docs(agents): drop duplicated Float and new Array rules
368fb93 docs: drop v3/v4 history from keyframes untagged-string error
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [postcss](https://github.com/postcss/postcss) to 8.5.10 and updates ancestor dependency [styled-components](https://github.com/styled-components/styled-components). These dependencies need to be updated together. Updates `postcss` from 8.4.49 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.49...8.5.10) Updates `styled-components` from 6.3.11 to 6.4.1 - [Release notes](https://github.com/styled-components/styled-components/releases) - [Commits](https://github.com/styled-components/styled-components/compare/styled-components@6.3.11...styled-components@6.4.1) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.10 dependency-type: indirect - dependency-name: styled-components dependency-version: 6.4.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

eps-autoapprove-dependabot