@depup/postcss 8.5.8-depup.0 → 8.5.21-depup.0

package/lib/stringifier.js

@@ -1,5 +1,21 @@
 'use strict'
 
+// Escapes sequences that could break out of an HTML <style> context.
+// Uses CSS unicode escaping (\3c = '<') which is valid CSS and parsed
+// correctly by all compliant CSS consumers.
+const STYLE_TAG = /(<)(\/?style\b)/gi
+const COMMENT_OPEN = /(<)(!--)/g
+
+// Characters that end an at-rule name, mirroring RE_AT_END in the tokenizer.
+// Params starting with anything else need a space to stay separate tokens.
+const AT_NAME_END = /[\t\n\f\r "#'()/;[\\\]{}]/
+
+function escapeHTMLInCSS(str) {
+  if (typeof str !== 'string') return str
+  if (!str.includes('<')) return str
+  return str.replace(STYLE_TAG, '\\3c $2').replace(COMMENT_OPEN, '\\3c $2')
+}
+
 const DEFAULT_RAW = {
   after: '\n',
   beforeClose: '\n',
@@ -19,26 +35,88 @@ function capitalize(str) {
   return str[0].toUpperCase() + str.slice(1)
 }
 
+function atruleStart(str, node) {
+  let name = '@' + node.name
+  let params = node.params ? str.rawValue(node, 'params') : ''
+  let afterName = node.raws.afterName
+
+  if (typeof afterName === 'undefined') {
+    afterName = params ? ' ' : ''
+  } else if (afterName === '' && params && !AT_NAME_END.test(params[0])) {
+    afterName = ' '
+  }
+
+  return name + afterName + params
+}
+
+function pushBody(str, stack, node) {
+  let nodes = node.nodes
+  let last = nodes.length - 1
+  while (last > 0) {
+    if (nodes[last].type !== 'comment') break
+    last -= 1
+  }
+
+  let semicolon = str.raw(node, 'semicolon')
+  let isDocument = node.type === 'document'
+  for (let i = nodes.length - 1; i >= 0; i--) {
+    let child = nodes[i]
+    let childSemicolon = last !== i || semicolon
+    // A childless at-rule that still has following siblings must be
+    // terminated. Without the semicolon those trailing comments are folded
+    // into the at-rule's prelude and disappear when the output is re-parsed.
+    if (
+      !childSemicolon &&
+      i < nodes.length - 1 &&
+      child.type === 'atrule' &&
+      !child.nodes
+    ) {
+      childSemicolon = true
+    }
+    stack.push({
+      document: isDocument,
+      node: child,
+      semicolon: childSemicolon
+    })
+  }
+}
+
+function pushBlock(str, stack, node, start) {
+  let between = str.raw(node, 'between', 'beforeOpen')
+  str.builder(escapeHTMLInCSS(start + between) + '{', node, 'start')
+
+  let hasNodes = node.nodes && node.nodes.length
+  let close = () => {
+    let after = hasNodes
+      ? str.raw(node, 'after')
+      : str.raw(node, 'after', 'emptyBody')
+    if (after) str.builder(escapeHTMLInCSS(after))
+    str.builder('}', node, 'end')
+    if (node.type === 'rule' && node.raws.ownSemicolon) {
+      str.builder(escapeHTMLInCSS(node.raws.ownSemicolon), node, 'end')
+    }
+  }
+
+  if (hasNodes) {
+    stack.push(close)
+    pushBody(str, stack, node)
+  } else {
+    close()
+  }
+}
+
 class Stringifier {
   constructor(builder) {
     this.builder = builder
   }
 
   atrule(node, semicolon) {
-    let name = '@' + node.name
-    let params = node.params ? this.rawValue(node, 'params') : ''
-
-    if (typeof node.raws.afterName !== 'undefined') {
-      name += node.raws.afterName
-    } else if (params) {
-      name += ' '
-    }
-
+    let start = atruleStart(this, node)
     if (node.nodes) {
-      this.block(node, name + params)
+      this.block(node, start)
     } else {
       let end = (node.raws.between || '') + (semicolon ? ';' : '')
-      this.builder(name + params + end, node)
+      this.builder(escapeHTMLInCSS(start + end), node)
     }
   }
 
@@ -73,7 +151,7 @@ class Stringifier {
 
   block(node, start) {
     let between = this.raw(node, 'between', 'beforeOpen')
-    this.builder(start + between + '{', node, 'start')
+    this.builder(escapeHTMLInCSS(start + between) + '{', node, 'start')
 
     let after
     if (node.nodes && node.nodes.length) {
@@ -83,42 +161,64 @@ class Stringifier {
       after = this.raw(node, 'after', 'emptyBody')
     }
 
-    if (after) this.builder(after)
+    if (after) this.builder(escapeHTMLInCSS(after))
     this.builder('}', node, 'end')
   }
 
   body(node) {
-    let last = node.nodes.length - 1
-    while (last > 0) {
-      if (node.nodes[last].type !== 'comment') break
-      last -= 1
-    }
+    // Rules and at-rules are expanded into an explicit stack instead of
+    // recursive `stringify()` calls to survive deeply nested trees.
+    // If a subclass changes the traversal methods, its children go
+    // through `stringify()` to keep the override in charge.
+    let proto = Stringifier.prototype
+    let expandable = ['atrule', 'block', 'body', 'rule', 'stringify'].every(
+      method => this[method] === proto[method]
+    )
+
+    let stack = []
+    pushBody(this, stack, node)
+
+    while (stack.length > 0) {
+      let entry = stack.pop()
+      if (typeof entry === 'function') {
+        entry()
+        continue
+      }
 
-    let semicolon = this.raw(node, 'semicolon')
-    for (let i = 0; i < node.nodes.length; i++) {
-      let child = node.nodes[i]
+      let child = entry.node
       let before = this.raw(child, 'before')
-      if (before) this.builder(before)
-      this.stringify(child, last !== i || semicolon)
+      if (before) {
+        this.builder(entry.document ? before : escapeHTMLInCSS(before))
+      }
+
+      if (expandable && child.type === 'rule') {
+        pushBlock(this, stack, child, this.rawValue(child, 'selector'))
+      } else if (expandable && child.type === 'atrule' && child.nodes) {
+        pushBlock(this, stack, child, atruleStart(this, child))
+      } else {
+        this.stringify(child, entry.semicolon)
+      }
     }
   }
 
   comment(node) {
     let left = this.raw(node, 'left', 'commentLeft')
     let right = this.raw(node, 'right', 'commentRight')
-    this.builder('/*' + left + node.text + right + '*/', node)
+    this.builder(escapeHTMLInCSS('/*' + left + node.text + right + '*/'), node)
   }
 
   decl(node, semicolon) {
+    let raws = node.raws
     let between = this.raw(node, 'between', 'colon')
+
     let string = node.prop + between + this.rawValue(node, 'value')
 
     if (node.important) {
-      string += node.raws.important || ' !important'
+      string += raws.important || ' !important'
     }
 
     if (semicolon) string += ';'
-    this.builder(string, node)
+    this.builder(escapeHTMLInCSS(string), node)
   }
 
   document(node) {
@@ -154,9 +254,9 @@ class Stringifier {
 
     // Detect style by other nodes
     let root = node.root()
-    if (!root.rawCache) root.rawCache = {}
-    if (typeof root.rawCache[detect] !== 'undefined') {
-      return root.rawCache[detect]
+    let cache = root.rawCache || (root.rawCache = {})
+    if (typeof cache[detect] !== 'undefined') {
+      return cache[detect]
     }
 
     if (detect === 'before' || detect === 'after') {
@@ -175,7 +275,7 @@ class Stringifier {
 
     if (typeof value === 'undefined') value = DEFAULT_RAW[detect]
 
-    root.rawCache[detect] = value
+    cache[detect] = value
     return value
   }
 
@@ -324,13 +424,17 @@ class Stringifier {
 
   root(node) {
     this.body(node)
-    if (node.raws.after) this.builder(node.raws.after)
+    if (node.raws.after) {
+      let after = node.raws.after
+      let isDocument = node.parent && node.parent.type === 'document'
+      this.builder(isDocument ? after : escapeHTMLInCSS(after))
+    }
   }
 
   rule(node) {
     this.block(node, this.rawValue(node, 'selector'))
     if (node.raws.ownSemicolon) {
-      this.builder(node.raws.ownSemicolon, node, 'end')
+      this.builder(escapeHTMLInCSS(node.raws.ownSemicolon), node, 'end')
     }
   }
 

package/lib/stringify.d.ts

@@ -4,6 +4,6 @@ interface Stringify extends Stringifier {
   default: Stringify
 }
 
-declare const stringify: Stringify
+declare let stringify: Stringify
 
 export = stringify

package/lib/tokenize.js

@@ -36,6 +36,7 @@ module.exports = function tokenizer(input, options = {}) {
   let pos = 0
   let buffer = []
   let returned = []
+  let lastBadParen = -1
 
   function position() {
     return pos
@@ -127,11 +128,14 @@ module.exports = function tokenizer(input, options = {}) {
           currentToken = ['brackets', css.slice(pos, next + 1), pos, next]
 
           pos = next
+        } else if (pos <= lastBadParen) {
+          currentToken = ['(', '(', pos]
         } else {
           next = css.indexOf(')', pos + 1)
           content = css.slice(pos, next + 1)
 
           if (next === -1 || RE_BAD_BRACKET.test(content)) {
+            lastBadParen = next === -1 ? length : next
             currentToken = ['(', '(', pos]
           } else {
             currentToken = ['brackets', content, pos, next]

package/lib/warning.d.ts

@@ -40,7 +40,6 @@ declare namespace Warning {
     word?: string
   }
 
-   
   export { Warning_ as default }
 }
 

package/lib/warning.js

@@ -1,11 +1,21 @@
 'use strict'
 
+let Container = require('./container')
+let { my } = require('./symbols')
+
 class Warning {
   constructor(text, opts = {}) {
     this.type = 'warning'
     this.text = text
 
     if (opts.node && opts.node.source) {
+      if (!opts.node[my]) {
+        // The node comes from another PostCSS copy in node_modules, so it does
+        // not have this copy’s methods. Container#normalize() rebuilds such
+        // nodes on insert, but a node passed straight to Result#warn() never
+        // goes through it.
+        Container.rebuild(opts.node)
+      }
       let range = opts.node.rangeBy(opts)
       this.line = range.start.line
       this.column = range.start.column

package/package.json

@@ -1,10 +1,53 @@
 {
   "name": "@depup/postcss",
-  "version": "8.5.8-depup.0",
-  "description": "[DepUp] Tool for transforming styles with JS plugins",
-  "engines": {
-    "node": "^10 || ^12 || >=14"
+  "version": "8.5.21-depup.0",
+  "description": "Tool for transforming styles with JS plugins (with updated dependencies)",
+  "keywords": [
+    "postcss",
+    "depup",
+    "updated-dependencies",
+    "security",
+    "latest",
+    "patched",
+    "css",
+    "manipulation",
+    "parser",
+    "preprocessor",
+    "rework",
+    "source map",
+    "transform",
+    "transpiler"
+  ],
+  "homepage": "https://postcss.org/",
+  "bugs": {
+    "url": "https://github.com/postcss/postcss/issues"
+  },
+  "license": "MIT",
+  "author": "Andrey Sitnik <andrey@sitnik.es>",
+  "repository": "postcss/postcss",
+  "funding": [
+    {
+      "type": "opencollective",
+      "url": "https://opencollective.com/postcss/"
+    },
+    {
+      "type": "tidelift",
+      "url": "https://tidelift.com/funding/github/npm/postcss"
+    },
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/ai"
+    }
+  ],
+  "main": "./lib/postcss.js",
+  "browser": {
+    "./lib/terminal-highlight": false,
+    "source-map-js": false,
+    "path": false,
+    "url": false,
+    "fs": false
   },
+  "types": "./lib/postcss.d.ts",
   "exports": {
     ".": {
       "import": "./lib/postcss.mjs",
@@ -39,66 +82,25 @@
     "./lib/warning": "./lib/warning.js",
     "./package.json": "./package.json"
   },
-  "main": "./lib/postcss.js",
-  "types": "./lib/postcss.d.ts",
-  "keywords": [
-    "depup",
-    "dependency-bumped",
-    "updated-deps",
-    "postcss",
-    "css",
-    "rework",
-    "preprocessor",
-    "parser",
-    "source map",
-    "transform",
-    "manipulation",
-    "transpiler"
-  ],
-  "funding": [
-    {
-      "type": "opencollective",
-      "url": "https://opencollective.com/postcss/"
-    },
-    {
-      "type": "tidelift",
-      "url": "https://tidelift.com/funding/github/npm/postcss"
-    },
-    {
-      "type": "github",
-      "url": "https://github.com/sponsors/ai"
-    }
-  ],
-  "author": "Andrey Sitnik <andrey@sitnik.ru>",
-  "license": "MIT",
-  "homepage": "https://postcss.org/",
-  "repository": "postcss/postcss",
-  "bugs": {
-    "url": "https://github.com/postcss/postcss/issues"
-  },
   "dependencies": {
-    "nanoid": "^5.1.6",
+    "nanoid": "^6.0.0",
     "picocolors": "^1.1.1",
     "source-map-js": "^1.2.1"
   },
-  "browser": {
-    "./lib/terminal-highlight": false,
-    "source-map-js": false,
-    "path": false,
-    "url": false,
-    "fs": false
+  "engines": {
+    "node": "^10 || ^12 || >=14"
   },
   "depup": {
     "changes": {
       "nanoid": {
-        "from": "^3.3.11",
-        "to": "^5.1.6"
+        "from": "^3.3.16",
+        "to": "^6.0.0"
       }
     },
     "depsUpdated": 1,
     "originalPackage": "postcss",
-    "originalVersion": "8.5.8",
-    "processedAt": "2026-03-09T04:19:08.351Z",
+    "originalVersion": "8.5.21",
+    "processedAt": "2026-07-21T17:29:18.301Z",
     "smokeTest": "passed"
   }
 }