@depup/postcss 8.5.9-depup.0 → 8.5.22-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/postcss
 
 | Field | Value |
 |-------|-------|
-| Original | [postcss](https://www.npmjs.com/package/postcss) @ 8.5.9 |
-| Processed | 2026-04-08 |
+| Original | [postcss](https://www.npmjs.com/package/postcss) @ 8.5.22 |
+| Processed | 2026-07-22 |
 | Smoke test | passed |
 | Deps updated | 1 |
 
@@ -22,7 +22,7 @@ npm install @depup/postcss
 
 | Dependency | From | To |
 |------------|------|-----|
-| nanoid | ^3.3.11 | ^5.1.7 |
+| nanoid | ^3.3.16 | ^6.0.0 |
 
 ---
 

package/changes.json

@@ -1,10 +1,10 @@
 {
   "bumped": {
     "nanoid": {
-      "from": "^3.3.11",
-      "to": "^5.1.7"
+      "from": "^3.3.16",
+      "to": "^6.0.0"
     }
   },
-  "timestamp": "2026-04-08T00:42:18.496Z",
+  "timestamp": "2026-07-22T08:55:33.566Z",
   "totalUpdated": 1
 }

package/lib/container.js

@@ -8,18 +8,25 @@ let { isClean, my } = require('./symbols')
 let AtRule, parse, Root, Rule
 
 function cleanSource(nodes) {
-  return nodes.map(i => {
-    if (i.nodes) i.nodes = cleanSource(i.nodes)
-    delete i.source
-    return i
-  })
+  let stack = nodes.slice()
+  while (stack.length > 0) {
+    let node = stack.pop()
+    delete node.source
+    if (node.nodes) {
+      node.nodes = node.nodes.slice()
+      for (let i of node.nodes) stack.push(i)
+    }
+  }
+  return nodes.slice()
 }
 
 function markTreeDirty(node) {
-  node[isClean] = false
-  if (node.proxyOf.nodes) {
-    for (let i of node.proxyOf.nodes) {
-      markTreeDirty(i)
+  let stack = [node]
+  while (stack.length > 0) {
+    let next = stack.pop()
+    next[isClean] = false
+    if (next.proxyOf.nodes) {
+      for (let i of next.proxyOf.nodes) stack.push(i)
     }
   }
 }
@@ -47,9 +54,18 @@ class Container extends Node {
   }
 
   cleanRaws(keepBetween) {
-    super.cleanRaws(keepBetween)
-    if (this.nodes) {
-      for (let node of this.nodes) node.cleanRaws(keepBetween)
+    let stack = [this]
+    while (stack.length > 0) {
+      let node = stack.pop()
+      if (node !== this && node.cleanRaws !== Container.prototype.cleanRaws) {
+        // Subclass with own logic; let it handle its subtree
+        node.cleanRaws(keepBetween)
+        continue
+      }
+      Node.prototype.cleanRaws.call(node, keepBetween)
+      if (node.nodes) {
+        for (let child of node.nodes) stack.push(child)
+      }
     }
   }
 
@@ -309,19 +325,48 @@ class Container extends Node {
   }
 
   walk(callback) {
-    return this.each((child, i) => {
+    if (!this.proxyOf.nodes) return undefined
+
+    // An explicit stack instead of recursive `each()` calls to survive
+    // deeply nested trees. Each frame keeps a live `indexes` slot, so
+    // insertion and removal during the walk behave like `each()`: the
+    // slot stays at the current child until its subtree is finished.
+    let stack = [{ iterator: this.getIterator(), node: this.proxyOf }]
+
+    while (stack.length > 0) {
+      let { iterator, node } = stack[stack.length - 1]
+      let index = node.indexes[iterator]
+
+      if (index >= node.proxyOf.nodes.length) {
+        delete node.indexes[iterator]
+        stack.pop()
+        let parent = stack[stack.length - 1]
+        // Finish the parent’s step for the child subtree we just left
+        if (parent) parent.node.indexes[parent.iterator] += 1
+        continue
+      }
+
+      let child = node.proxyOf.nodes[index]
       let result
       try {
-        result = callback(child, i)
+        result = callback(child, index)
       } catch (e) {
         throw child.addToError(e)
       }
-      if (result !== false && child.walk) {
-        result = child.walk(callback)
+      if (result === false) {
+        for (let opened of stack) {
+          delete opened.node.indexes[opened.iterator]
+        }
+        return false
+      }
+      if (child.walk && child.proxyOf.nodes) {
+        stack.push({ iterator: child.getIterator(), node: child })
+      } else {
+        node.indexes[iterator] += 1
       }
+    }
 
-      return result
-    })
+    return undefined
   }
 
   walkAtRules(name, callback) {
@@ -424,24 +469,26 @@ Container.default = Container
 
 /* c8 ignore start */
 Container.rebuild = node => {
-  if (node.type === 'atrule') {
-    Object.setPrototypeOf(node, AtRule.prototype)
-  } else if (node.type === 'rule') {
-    Object.setPrototypeOf(node, Rule.prototype)
-  } else if (node.type === 'decl') {
-    Object.setPrototypeOf(node, Declaration.prototype)
-  } else if (node.type === 'comment') {
-    Object.setPrototypeOf(node, Comment.prototype)
-  } else if (node.type === 'root') {
-    Object.setPrototypeOf(node, Root.prototype)
-  }
+  let stack = [node]
+  while (stack.length > 0) {
+    let next = stack.pop()
+    if (next.type === 'atrule') {
+      Object.setPrototypeOf(next, AtRule.prototype)
+    } else if (next.type === 'rule') {
+      Object.setPrototypeOf(next, Rule.prototype)
+    } else if (next.type === 'decl') {
+      Object.setPrototypeOf(next, Declaration.prototype)
+    } else if (next.type === 'comment') {
+      Object.setPrototypeOf(next, Comment.prototype)
+    } else if (next.type === 'root') {
+      Object.setPrototypeOf(next, Root.prototype)
+    }
 
-  node[my] = true
+    next[my] = true
 
-  if (node.nodes) {
-    node.nodes.forEach(child => {
-      Container.rebuild(child)
-    })
+    if (next.nodes) {
+      for (let child of next.nodes) stack.push(child)
+    }
   }
 }
 /* c8 ignore stop */

package/lib/fromJSON.js

@@ -8,26 +8,24 @@ let PreviousMap = require('./previous-map')
 let Root = require('./root')
 let Rule = require('./rule')
 
-function fromJSON(json, inputs) {
-  if (Array.isArray(json)) return json.map(n => fromJSON(n))
-
-  let { inputs: ownInputs, ...defaults } = json
-  if (ownInputs) {
-    inputs = []
-    for (let input of ownInputs) {
-      let inputHydrated = { ...input, __proto__: Input.prototype }
-      if (inputHydrated.map) {
-        inputHydrated.map = {
-          ...inputHydrated.map,
-          __proto__: PreviousMap.prototype
-        }
+function hydrateInputs(json, inputs) {
+  if (!json.inputs) return inputs
+  return json.inputs.map(input => {
+    let inputHydrated = { ...input, __proto__: Input.prototype }
+    if (inputHydrated.map) {
+      inputHydrated.map = {
+        ...inputHydrated.map,
+        __proto__: PreviousMap.prototype
       }
-      inputs.push(inputHydrated)
     }
-  }
-  if (defaults.nodes) {
-    defaults.nodes = json.nodes.map(n => fromJSON(n, inputs))
-  }
+    return inputHydrated
+  })
+}
+
+function constructNode(json, inputs, children) {
+  let defaults = { ...json }
+  delete defaults.inputs
+  delete defaults.nodes
   if (defaults.source) {
     let { inputId, ...source } = defaults.source
     defaults.source = source
@@ -35,19 +33,74 @@ function fromJSON(json, inputs) {
       defaults.source.input = inputs[inputId]
     }
   }
+
+  let node
   if (defaults.type === 'root') {
-    return new Root(defaults)
+    node = new Root(defaults)
   } else if (defaults.type === 'decl') {
-    return new Declaration(defaults)
+    node = new Declaration(defaults)
   } else if (defaults.type === 'rule') {
-    return new Rule(defaults)
+    node = new Rule(defaults)
   } else if (defaults.type === 'comment') {
-    return new Comment(defaults)
+    node = new Comment(defaults)
   } else if (defaults.type === 'atrule') {
-    return new AtRule(defaults)
+    node = new AtRule(defaults)
   } else {
     throw new Error('Unknown node type: ' + json.type)
   }
+
+  // Rehydrated children are attached after construction. Passing them
+  // through the container constructor would re-run insertion spacing
+  // normalization and overwrite each child's own `raws.before`.
+  if (children) {
+    node.nodes = children
+    for (let child of children) child.parent = node
+  }
+
+  return node
+}
+
+function fromJSON(json, inputs) {
+  if (Array.isArray(json)) return json.map(n => fromJSON(n))
+
+  // An explicit stack instead of recursive calls to survive deeply
+  // nested trees. Children are rehydrated before their parent node
+  // is constructed.
+  let result
+  let stack = [
+    { childIndex: 0, children: [], inputs: hydrateInputs(json, inputs), json }
+  ]
+
+  while (stack.length > 0) {
+    let frame = stack[stack.length - 1]
+    let jsonNodes = frame.json.nodes
+
+    if (jsonNodes && frame.childIndex < jsonNodes.length) {
+      let childJson = jsonNodes[frame.childIndex]
+      frame.childIndex += 1
+      stack.push({
+        childIndex: 0,
+        children: [],
+        inputs: hydrateInputs(childJson, frame.inputs),
+        json: childJson
+      })
+      continue
+    }
+
+    stack.pop()
+    let node = constructNode(
+      frame.json,
+      frame.inputs,
+      jsonNodes ? frame.children : undefined
+    )
+    if (stack.length > 0) {
+      stack[stack.length - 1].children.push(node)
+    } else {
+      result = node
+    }
+  }
+
+  return result
 }
 
 module.exports = fromJSON

package/lib/input.js

@@ -206,12 +206,21 @@ class Input {
     if (!this.map) return false
     let consumer = this.map.consumer()
 
-    let from = consumer.originalPositionFor({ column, line })
+    let from = consumer.originalPositionFor({ column: column - 1, line })
     if (!from.source) return false
 
     let to
     if (typeof endLine === 'number') {
-      to = consumer.originalPositionFor({ column: endColumn, line: endLine })
+      let toPosition = consumer.originalPositionFor({
+        column: endColumn - 1,
+        line: endLine
+      })
+      // The source map may not have a mapping that covers the end position
+      // (`originalPositionFor()` then returns `null` for `line`/`column`
+      // instead of omitting them). Treat that the same as not requesting
+      // an end position at all, so `endLine`/`endColumn` stay a consistent
+      // `undefined` pair instead of a mix of `null` and a bogus number.
+      if (toPosition.source) to = toPosition
     }
 
     let fromUrl
@@ -226,8 +235,8 @@ class Input {
     }
 
     let result = {
-      column: from.column,
-      endColumn: to && to.column,
+      column: from.column + 1,
+      endColumn: to && to.column + 1,
       endLine: to && to.line,
       line: from.line,
       url: fromUrl.toString()

package/lib/lazy-result.js

@@ -97,8 +97,14 @@ function toStack(node) {
 }
 
 function cleanMarks(node) {
-  node[isClean] = false
-  if (node.nodes) node.nodes.forEach(i => cleanMarks(i))
+  let stack = [node]
+  while (stack.length > 0) {
+    let next = stack.pop()
+    next[isClean] = false
+    if (next.nodes) {
+      for (let i of next.nodes) stack.push(i)
+    }
+  }
   return node
 }
 
@@ -378,6 +384,19 @@ class LazyResult {
     if (opts.stringifier) str = opts.stringifier
     if (str.stringify) str = str.stringify
 
+    let rootSource = this.result.root.source
+    if (
+      opts.map === undefined &&
+      !(rootSource && rootSource.input && rootSource.input.map)
+    ) {
+      let result = ''
+      str(this.result.root, i => {
+        result += i
+      })
+      this.result.css = result
+      return this.result
+    }
+
     let map = new MapGenerator(str, this.result.root, this.result.opts)
     let data = map.generate()
     this.result.css = data[0]
@@ -516,21 +535,57 @@ class LazyResult {
   }
 
   walkSync(node) {
+    // An explicit stack like in async `visitTick()` to survive deeply
+    // nested trees. Unlike `visitTick()`, nodes are marked clean only
+    // on entering, so a node dirtied by its own visitors is revisited
+    // on the next pass.
     node[isClean] = true
-    let events = getEvents(node)
-    for (let event of events) {
-      if (event === CHILDREN) {
-        if (node.nodes) {
-          node.each(child => {
-            if (!child[isClean]) this.walkSync(child)
-          })
+    let stack = [{ eventIndex: 0, events: getEvents(node), iterator: 0, node }]
+
+    while (stack.length > 0) {
+      let visit = stack[stack.length - 1]
+      let visitNode = visit.node
+
+      if (visit.iterator !== 0) {
+        let iterator = visit.iterator
+        let child
+        let descended = false
+        while ((child = visitNode.nodes[visitNode.indexes[iterator]])) {
+          visitNode.indexes[iterator] += 1
+          if (!child[isClean]) {
+            child[isClean] = true
+            stack.push({
+              eventIndex: 0,
+              events: getEvents(child),
+              iterator: 0,
+              node: child
+            })
+            descended = true
+            break
+          }
         }
-      } else {
-        let visitors = this.listeners[event]
-        if (visitors) {
-          if (this.visitSync(visitors, node.toProxy())) return
+        if (descended) continue
+        visit.iterator = 0
+        delete visitNode.indexes[iterator]
+      }
+
+      if (visit.eventIndex < visit.events.length) {
+        let event = visit.events[visit.eventIndex]
+        visit.eventIndex += 1
+        if (event === CHILDREN) {
+          if (visitNode.nodes && visitNode.nodes.length) {
+            visit.iterator = visitNode.getIterator()
+          }
+        } else {
+          let visitors = this.listeners[event]
+          if (visitors) {
+            if (this.visitSync(visitors, visitNode.toProxy())) stack.pop()
+          }
         }
+        continue
       }
+
+      stack.pop()
     }
   }
 

package/lib/node.d.ts

@@ -31,12 +31,12 @@ declare namespace Node {
 
   export interface Position {
     /**
-     * Source line in file. In contrast to `offset` it starts from 1.
+     * Source column in file. It starts from 1.
      */
     column: number
 
     /**
-     * Source column in file.
+     * Source line in file. It starts from 1.
      */
     line: number
 

package/lib/node.js

@@ -7,25 +7,41 @@ let { isClean, my } = require('./symbols')
 
 function cloneNode(obj, parent) {
   let cloned = new obj.constructor()
-
-  for (let i in obj) {
-    if (!Object.prototype.hasOwnProperty.call(obj, i)) {
-      /* c8 ignore next 2 */
-      continue
-    }
-    if (i === 'proxyCache') continue
-    let value = obj[i]
-    let type = typeof value
-
-    if (i === 'parent' && type === 'object') {
-      if (parent) cloned[i] = parent
-    } else if (i === 'source') {
-      cloned[i] = value
-    } else if (Array.isArray(value)) {
-      cloned[i] = value.map(j => cloneNode(j, cloned))
-    } else {
-      if (type === 'object' && value !== null) value = cloneNode(value)
-      cloned[i] = value
+  // An explicit stack instead of recursive calls to survive deeply
+  // nested trees. Each entry is [source, its clone, clone's parent].
+  let stack = [[obj, cloned, parent]]
+
+  while (stack.length > 0) {
+    let [source, target, targetParent] = stack.pop()
+    for (let i in source) {
+      if (!Object.prototype.hasOwnProperty.call(source, i)) {
+        /* c8 ignore next 2 */
+        continue
+      }
+      if (i === 'proxyCache') continue
+      let value = source[i]
+      let type = typeof value
+
+      if (i === 'parent' && type === 'object') {
+        if (targetParent) target[i] = targetParent
+      } else if (i === 'source') {
+        target[i] = value
+      } else if (Array.isArray(value)) {
+        let children = []
+        target[i] = children
+        for (let j of value) {
+          let childClone = new j.constructor()
+          children.push(childClone)
+          stack.push([j, childClone, target])
+        }
+      } else {
+        if (type === 'object' && value !== null) {
+          let valueClone = new value.constructor()
+          stack.push([value, valueClone, undefined])
+          value = valueClone
+        }
+        target[i] = value
+      }
     }
   }
 
@@ -69,11 +85,15 @@ class Node {
     this[isClean] = false
     this[my] = true
 
-    for (let name in defaults) {
+    for (let name of Object.keys(defaults)) {
+      if (name === '__proto__') continue
       if (name === 'nodes') {
         this.nodes = []
         for (let node of defaults[name]) {
-          if (typeof node.clone === 'function') {
+          // Clone only nodes that already belong to another tree, so passing a
+          // freshly created (parent-less) node adopts that instance instead of
+          // a copy and keeps the caller's reference usable. See #1987.
+          if (typeof node.clone === 'function' && node.parent) {
             this.append(node.clone())
           } else {
             this.append(node)
@@ -206,14 +226,18 @@ class Node {
   }
 
   positionBy(opts = {}) {
-    let pos = this.source.start
+    let inputString =
+      'document' in this.source.input
+        ? this.source.input.document
+        : this.source.input.css
+    let pos = {
+      column: this.source.start.column,
+      line: this.source.start.line,
+      offset: sourceOffset(inputString, this.source.start)
+    }
     if (opts.index) {
       pos = this.positionInside(opts.index)
     } else if (opts.word) {
-      let inputString =
-        'document' in this.source.input
-          ? this.source.input.document
-          : this.source.input.css
       let stringRepresentation = inputString.slice(
         sourceOffset(inputString, this.source.start),
         sourceOffset(inputString, this.source.end)
@@ -298,7 +322,7 @@ class Node {
           line: opts.start.line,
           offset: sourceOffset(inputString, opts.start)
         }
-      } else if (opts.index) {
+      } else if (typeof opts.index === 'number') {
         start = this.positionInside(opts.index)
       }
 
@@ -310,7 +334,7 @@ class Node {
         }
       } else if (typeof opts.endIndex === 'number') {
         end = this.positionInside(opts.endIndex)
-      } else if (opts.index) {
+      } else if (typeof opts.index === 'number') {
         end = this.positionInside(opts.index + 1)
       }
     }
@@ -374,47 +398,68 @@ class Node {
   }
 
   toJSON(_, inputs) {
-    let fixed = {}
     let emitInputs = inputs == null
     inputs = inputs || new Map()
-    let inputsNextIndex = 0
-
-    for (let name in this) {
-      if (!Object.prototype.hasOwnProperty.call(this, name)) {
-        /* c8 ignore next 2 */
-        continue
-      }
-      if (name === 'parent' || name === 'proxyCache') continue
-      let value = this[name]
 
-      if (Array.isArray(value)) {
-        fixed[name] = value.map(i => {
-          if (typeof i === 'object' && i.toJSON) {
-            return i.toJSON(null, inputs)
+    // A worklist instead of recursive `toJSON()` calls to survive deeply
+    // nested trees. Each entry converts one node and writes the result
+    // into the already converted parent by [holder, key].
+    let holderOfRoot = []
+    let queue = [[this, holderOfRoot, 0]]
+
+    for (let step = 0; step < queue.length; step++) {
+      let [node, holder, key] = queue[step]
+      let fixed = {}
+      holder[key] = fixed
+
+      for (let name in node) {
+        if (!Object.prototype.hasOwnProperty.call(node, name)) {
+          /* c8 ignore next 2 */
+          continue
+        }
+        if (name === 'parent' || name === 'proxyCache') continue
+        let value = node[name]
+
+        if (Array.isArray(value)) {
+          let fixedArray = []
+          fixed[name] = fixedArray
+          for (let i = 0; i < value.length; i++) {
+            let item = value[i]
+            if (typeof item === 'object' && item.toJSON) {
+              if (item.toJSON === Node.prototype.toJSON) {
+                queue.push([item, fixedArray, i])
+              } else {
+                fixedArray[i] = item.toJSON(null, inputs)
+              }
+            } else {
+              fixedArray[i] = item
+            }
+          }
+        } else if (typeof value === 'object' && value.toJSON) {
+          if (value.toJSON === Node.prototype.toJSON) {
+            queue.push([value, fixed, name])
           } else {
-            return i
+            fixed[name] = value.toJSON(null, inputs)
           }
-        })
-      } else if (typeof value === 'object' && value.toJSON) {
-        fixed[name] = value.toJSON(null, inputs)
-      } else if (name === 'source') {
-        if (value == null) continue
-        let inputId = inputs.get(value.input)
-        if (inputId == null) {
-          inputId = inputsNextIndex
-          inputs.set(value.input, inputsNextIndex)
-          inputsNextIndex++
-        }
-        fixed[name] = {
-          end: value.end,
-          inputId,
-          start: value.start
+        } else if (name === 'source') {
+          if (value == null) continue
+          let inputId = inputs.get(value.input)
+          if (inputId == null) {
+            inputId = inputs.size
+            inputs.set(value.input, inputId)
+          }
+          fixed[name] = {
+            end: value.end,
+            inputId,
+            start: value.start
+          }
+        } else {
+          fixed[name] = value
         }
-      } else {
-        fixed[name] = value
       }
     }
 
+    let fixed = holderOfRoot[0]
     if (emitInputs) {
       fixed.inputs = [...inputs.keys()].map(input => input.toJSON())
     }

package/lib/parser.js

@@ -20,6 +20,12 @@ function findLastWithPosition(tokens) {
   }
 }
 
+function tokensToString(tokens, from, to) {
+  let result = ''
+  for (let i = from; i < to; i++) result += tokens[i][1]
+  return result
+}
+
 class Parser {
   constructor(input) {
     this.input = input
@@ -132,9 +138,10 @@ class Parser {
         if (founded === 2) break
       }
     }
-    // If the token is a word, e.g. `!important`, `red` or any other valid property's value.
-    // Then we need to return the colon after that word token. [3] is the "end" colon of that word.
-    // And because we need it after that one we do +1 to get the next one.
+    // If the token is a word, e.g. `!important`, `red` or any other valid
+    // property's value. Then we need to return the colon after that word
+    // token. [3] is the "end" colon of that word. And because we need it
+    // after that one we do +1 to get the next one.
     throw this.input.error(
       'Missed semicolon',
       token[0] === 'word' ? token[3] + 1 : token[2]
@@ -207,50 +214,50 @@ class Parser {
     )
     node.source.end.offset++
 
-    while (tokens[0][0] !== 'word') {
-      if (tokens.length === 1) this.unknownWord(tokens)
-      node.raws.before += tokens.shift()[1]
+    let start = 0
+    while (tokens[start][0] !== 'word') {
+      if (start === tokens.length - 1) this.unknownWord([tokens[start]])
+      start++
     }
-    node.source.start = this.getPosition(tokens[0][2])
+    node.raws.before += tokensToString(tokens, 0, start)
+    node.source.start = this.getPosition(tokens[start][2])
 
-    node.prop = ''
-    while (tokens.length) {
-      let type = tokens[0][0]
+    let propStart = start
+    while (start < tokens.length) {
+      let type = tokens[start][0]
       if (type === ':' || type === 'space' || type === 'comment') {
         break
       }
-      node.prop += tokens.shift()[1]
+      start++
     }
+    node.prop = tokensToString(tokens, propStart, start)
 
-    node.raws.between = ''
-
+    let betweenStart = start
     let token
-    while (tokens.length) {
-      token = tokens.shift()
-
-      if (token[0] === ':') {
-        node.raws.between += token[1]
-        break
-      } else {
-        if (token[0] === 'word' && /\w/.test(token[1])) {
-          this.unknownWord([token])
-        }
-        node.raws.between += token[1]
+    while (start < tokens.length) {
+      token = tokens[start]
+      start++
+      if (token[0] === ':') break
+      if (token[0] === 'word' && /\w/.test(token[1])) {
+        this.unknownWord([token])
       }
     }
+    node.raws.between = tokensToString(tokens, betweenStart, start)
 
     if (node.prop[0] === '_' || node.prop[0] === '*') {
       node.raws.before += node.prop[0]
       node.prop = node.prop.slice(1)
     }
 
-    let firstSpaces = []
-    let next
-    while (tokens.length) {
-      next = tokens[0][0]
+    let firstSpacesStart = start
+    while (start < tokens.length) {
+      let next = tokens[start][0]
       if (next !== 'space' && next !== 'comment') break
-      firstSpaces.push(tokens.shift())
+      start++
     }
+    let firstSpaces = tokens.slice(firstSpacesStart, start)
+
+    tokens = tokens.slice(start)
 
     this.precheckMissedSemicolon(tokens)
 

package/lib/postcss.d.ts

@@ -229,7 +229,7 @@ declare namespace postcss {
   export interface Parser<RootNode = Document | Root> {
     (
       css: { toString(): string } | string,
-      opts?: Pick<ProcessOptions, 'document' | 'from' | 'map'>
+      opts?: Pick<ProcessOptions, 'document' | 'from' | 'map' | 'unsafeMap'>
     ): RootNode
   }
 
@@ -351,6 +351,14 @@ declare namespace postcss {
      * to generate correct source maps.
      */
     to?: string
+
+    /**
+     * Disable source map file protections.
+     *
+     * By default source map is limited only for `.map` files
+     * in the `from` folder.
+     */
+    unsafeMap?: boolean
   }
 
   export type Postcss = typeof postcss

package/lib/previous-map.js

@@ -1,7 +1,7 @@
 'use strict'
 
 let { existsSync, readFileSync } = require('fs')
-let { dirname, join } = require('path')
+let { dirname, isAbsolute, join, relative, sep } = require('path')
 let { SourceMapConsumer, SourceMapGenerator } = require('source-map-js')
 
 function fromBase64(str) {
@@ -16,6 +16,7 @@ function fromBase64(str) {
 class PreviousMap {
   constructor(css, opts) {
     if (opts.map === false) return
+    if (opts.unsafeMap) this.unsafeMap = true
     this.loadAnnotation(css)
     this.inline = this.startWith(this.annotation, 'data:')
 
@@ -30,7 +31,7 @@ class PreviousMap {
 
   consumer() {
     if (!this.consumerCache) {
-      this.consumerCache = new SourceMapConsumer(this.text)
+      this.consumerCache = new SourceMapConsumer(this.json || this.text)
     }
     return this.consumerCache
   }
@@ -83,7 +84,22 @@ class PreviousMap {
     }
   }
 
-  loadFile(path) {
+  loadFile(path, cssFile, trusted) {
+    if (!trusted && !this.unsafeMap) {
+      if (!/\.map$/i.test(path)) {
+        return undefined
+      }
+      if (cssFile) {
+        let relativePath = relative(dirname(cssFile), path)
+        if (
+          relativePath === '..' ||
+          relativePath.startsWith('..' + sep) ||
+          isAbsolute(relativePath)
+        ) {
+          return undefined
+        }
+      }
+    }
     this.root = dirname(path)
     if (existsSync(path)) {
       this.mapFile = path
@@ -100,7 +116,7 @@ class PreviousMap {
       } else if (typeof prev === 'function') {
         let prevPath = prev(file)
         if (prevPath) {
-          let map = this.loadFile(prevPath)
+          let map = this.loadFile(prevPath, file, true)
           if (!map) {
             throw new Error(
               'Unable to load previous source map: ' + prevPath.toString()
@@ -124,7 +140,16 @@ class PreviousMap {
     } else if (this.annotation) {
       let map = this.annotation
       if (file) map = join(dirname(file), map)
-      return this.loadFile(map)
+      let unknown = this.loadFile(map, file, false)
+      if (unknown) {
+        try {
+          /* c8 ignore next 4 */
+          this.json = JSON.parse(unknown.replace(/^\)]}'[^\n]*\n/, ''))
+        } catch {
+          return undefined
+        }
+      }
+      return unknown
     }
   }
 

package/lib/processor.js

@@ -7,7 +7,7 @@ let Root = require('./root')
 
 class Processor {
   constructor(plugins = []) {
-    this.version = '8.5.9'
+    this.version = '8.5.22'
     this.plugins = this.normalize(plugins)
   }
 

package/lib/root.js

@@ -12,6 +12,19 @@ class Root extends Container {
   }
 
   normalize(child, sample, type) {
+    let keepBefore = new Set()
+    for (let node of Array.isArray(child) ? child : [child]) {
+      if (
+        node &&
+        typeof node === 'object' &&
+        !node.parent &&
+        node.raws &&
+        typeof node.raws.before !== 'undefined'
+      ) {
+        keepBefore.add(node.raws)
+      }
+    }
+
     let nodes = super.normalize(child)
 
     if (sample) {
@@ -23,7 +36,9 @@ class Root extends Container {
         }
       } else if (this.first !== sample) {
         for (let node of nodes) {
-          node.raws.before = sample.raws.before
+          if (!keepBefore.has(node.raws)) {
+            node.raws.before = sample.raws.before
+          }
         }
       }
     }

package/lib/stringifier.js

@@ -1,5 +1,21 @@
 'use strict'
 
+// Escapes sequences that could break out of an HTML <style> context.
+// Uses CSS unicode escaping (\3c = '<') which is valid CSS and parsed
+// correctly by all compliant CSS consumers.
+const STYLE_TAG = /(<)(\/?style\b)/gi
+const COMMENT_OPEN = /(<)(!--)/g
+
+// Characters that end an at-rule name, mirroring RE_AT_END in the tokenizer.
+// Params starting with anything else need a space to stay separate tokens.
+const AT_NAME_END = /[\t\n\f\r "#'()/;[\\\]{}]/
+
+function escapeHTMLInCSS(str) {
+  if (typeof str !== 'string') return str
+  if (!str.includes('<')) return str
+  return str.replace(STYLE_TAG, '\\3c $2').replace(COMMENT_OPEN, '\\3c $2')
+}
+
 const DEFAULT_RAW = {
   after: '\n',
   beforeClose: '\n',
@@ -19,26 +35,89 @@ function capitalize(str) {
   return str[0].toUpperCase() + str.slice(1)
 }
 
+function atruleStart(str, node) {
+  let name = '@' + node.name
+  let params = node.params ? str.rawValue(node, 'params') : ''
+  let afterName = node.raws.afterName
+
+  if (typeof afterName === 'undefined') {
+    afterName = params ? ' ' : ''
+  } else if (afterName === '' && params && !AT_NAME_END.test(params[0])) {
+    afterName = ' '
+  }
+
+  return name + afterName + params
+}
+
+function pushBody(str, stack, node) {
+  let nodes = node.nodes
+  let last = nodes.length - 1
+  while (last > 0) {
+    if (nodes[last].type !== 'comment') break
+    last -= 1
+  }
+
+  let semicolon = str.raw(node, 'semicolon')
+  let isDocument = node.type === 'document'
+  for (let i = nodes.length - 1; i >= 0; i--) {
+    let child = nodes[i]
+    let childSemicolon = last !== i || semicolon
+    // A childless at-rule or a custom property declaration that still has
+    // following siblings must be terminated. Without the semicolon those
+    // trailing comments are folded into the at-rule's prelude or the custom
+    // property's value and disappear when the output is re-parsed.
+    if (
+      !childSemicolon &&
+      i < nodes.length - 1 &&
+      ((child.type === 'atrule' && !child.nodes) ||
+        (child.type === 'decl' && child.prop.startsWith('--')))
+    ) {
+      childSemicolon = true
+    }
+    stack.push({
+      document: isDocument,
+      node: child,
+      semicolon: childSemicolon
+    })
+  }
+}
+
+function pushBlock(str, stack, node, start) {
+  let between = str.raw(node, 'between', 'beforeOpen')
+  str.builder(escapeHTMLInCSS(start + between) + '{', node, 'start')
+
+  let hasNodes = node.nodes && node.nodes.length
+  let close = () => {
+    let after = hasNodes
+      ? str.raw(node, 'after')
+      : str.raw(node, 'after', 'emptyBody')
+    if (after) str.builder(escapeHTMLInCSS(after))
+    str.builder('}', node, 'end')
+    if (node.type === 'rule' && node.raws.ownSemicolon) {
+      str.builder(escapeHTMLInCSS(node.raws.ownSemicolon), node, 'end')
+    }
+  }
+
+  if (hasNodes) {
+    stack.push(close)
+    pushBody(str, stack, node)
+  } else {
+    close()
+  }
+}
+
 class Stringifier {
   constructor(builder) {
     this.builder = builder
   }
 
   atrule(node, semicolon) {
-    let name = '@' + node.name
-    let params = node.params ? this.rawValue(node, 'params') : ''
-
-    if (typeof node.raws.afterName !== 'undefined') {
-      name += node.raws.afterName
-    } else if (params) {
-      name += ' '
-    }
-
+    let start = atruleStart(this, node)
     if (node.nodes) {
-      this.block(node, name + params)
+      this.block(node, start)
     } else {
       let end = (node.raws.between || '') + (semicolon ? ';' : '')
-      this.builder(name + params + end, node)
+      this.builder(escapeHTMLInCSS(start + end), node)
     }
   }
 
@@ -73,7 +152,7 @@ class Stringifier {
 
   block(node, start) {
     let between = this.raw(node, 'between', 'beforeOpen')
-    this.builder(start + between + '{', node, 'start')
+    this.builder(escapeHTMLInCSS(start + between) + '{', node, 'start')
 
     let after
     if (node.nodes && node.nodes.length) {
@@ -83,42 +162,64 @@ class Stringifier {
       after = this.raw(node, 'after', 'emptyBody')
     }
 
-    if (after) this.builder(after)
+    if (after) this.builder(escapeHTMLInCSS(after))
     this.builder('}', node, 'end')
   }
 
   body(node) {
-    let last = node.nodes.length - 1
-    while (last > 0) {
-      if (node.nodes[last].type !== 'comment') break
-      last -= 1
-    }
+    // Rules and at-rules are expanded into an explicit stack instead of
+    // recursive `stringify()` calls to survive deeply nested trees.
+    // If a subclass changes the traversal methods, its children go
+    // through `stringify()` to keep the override in charge.
+    let proto = Stringifier.prototype
+    let expandable = ['atrule', 'block', 'body', 'rule', 'stringify'].every(
+      method => this[method] === proto[method]
+    )
+
+    let stack = []
+    pushBody(this, stack, node)
+
+    while (stack.length > 0) {
+      let entry = stack.pop()
+      if (typeof entry === 'function') {
+        entry()
+        continue
+      }
 
-    let semicolon = this.raw(node, 'semicolon')
-    for (let i = 0; i < node.nodes.length; i++) {
-      let child = node.nodes[i]
+      let child = entry.node
       let before = this.raw(child, 'before')
-      if (before) this.builder(before)
-      this.stringify(child, last !== i || semicolon)
+      if (before) {
+        this.builder(entry.document ? before : escapeHTMLInCSS(before))
+      }
+
+      if (expandable && child.type === 'rule') {
+        pushBlock(this, stack, child, this.rawValue(child, 'selector'))
+      } else if (expandable && child.type === 'atrule' && child.nodes) {
+        pushBlock(this, stack, child, atruleStart(this, child))
+      } else {
+        this.stringify(child, entry.semicolon)
+      }
     }
   }
 
   comment(node) {
     let left = this.raw(node, 'left', 'commentLeft')
     let right = this.raw(node, 'right', 'commentRight')
-    this.builder('/*' + left + node.text + right + '*/', node)
+    this.builder(escapeHTMLInCSS('/*' + left + node.text + right + '*/'), node)
   }
 
   decl(node, semicolon) {
+    let raws = node.raws
     let between = this.raw(node, 'between', 'colon')
+
     let string = node.prop + between + this.rawValue(node, 'value')
 
     if (node.important) {
-      string += node.raws.important || ' !important'
+      string += raws.important || ' !important'
     }
 
     if (semicolon) string += ';'
-    this.builder(string, node)
+    this.builder(escapeHTMLInCSS(string), node)
   }
 
   document(node) {
@@ -154,9 +255,9 @@ class Stringifier {
 
     // Detect style by other nodes
     let root = node.root()
-    if (!root.rawCache) root.rawCache = {}
-    if (typeof root.rawCache[detect] !== 'undefined') {
-      return root.rawCache[detect]
+    let cache = root.rawCache || (root.rawCache = {})
+    if (typeof cache[detect] !== 'undefined') {
+      return cache[detect]
     }
 
     if (detect === 'before' || detect === 'after') {
@@ -175,7 +276,7 @@ class Stringifier {
 
     if (typeof value === 'undefined') value = DEFAULT_RAW[detect]
 
-    root.rawCache[detect] = value
+    cache[detect] = value
     return value
   }
 
@@ -324,13 +425,17 @@ class Stringifier {
 
   root(node) {
     this.body(node)
-    if (node.raws.after) this.builder(node.raws.after)
+    if (node.raws.after) {
+      let after = node.raws.after
+      let isDocument = node.parent && node.parent.type === 'document'
+      this.builder(isDocument ? after : escapeHTMLInCSS(after))
+    }
   }
 
   rule(node) {
     this.block(node, this.rawValue(node, 'selector'))
     if (node.raws.ownSemicolon) {
-      this.builder(node.raws.ownSemicolon, node, 'end')
+      this.builder(escapeHTMLInCSS(node.raws.ownSemicolon), node, 'end')
     }
   }
 

package/lib/tokenize.js

@@ -36,6 +36,7 @@ module.exports = function tokenizer(input, options = {}) {
   let pos = 0
   let buffer = []
   let returned = []
+  let lastBadParen = -1
 
   function position() {
     return pos
@@ -127,11 +128,14 @@ module.exports = function tokenizer(input, options = {}) {
           currentToken = ['brackets', css.slice(pos, next + 1), pos, next]
 
           pos = next
+        } else if (pos <= lastBadParen) {
+          currentToken = ['(', '(', pos]
         } else {
           next = css.indexOf(')', pos + 1)
           content = css.slice(pos, next + 1)
 
           if (next === -1 || RE_BAD_BRACKET.test(content)) {
+            lastBadParen = next === -1 ? length : next
             currentToken = ['(', '(', pos]
           } else {
             currentToken = ['brackets', content, pos, next]

package/lib/warning.js

@@ -1,11 +1,21 @@
 'use strict'
 
+let Container = require('./container')
+let { my } = require('./symbols')
+
 class Warning {
   constructor(text, opts = {}) {
     this.type = 'warning'
     this.text = text
 
     if (opts.node && opts.node.source) {
+      if (!opts.node[my]) {
+        // The node comes from another PostCSS copy in node_modules, so it does
+        // not have this copy’s methods. Container#normalize() rebuilds such
+        // nodes on insert, but a node passed straight to Result#warn() never
+        // goes through it.
+        Container.rebuild(opts.node)
+      }
       let range = opts.node.rangeBy(opts)
       this.line = range.start.line
       this.column = range.start.column

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/postcss",
-  "version": "8.5.9-depup.0",
+  "version": "8.5.22-depup.0",
   "description": "Tool for transforming styles with JS plugins (with updated dependencies)",
   "keywords": [
     "postcss",
@@ -83,7 +83,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "nanoid": "^5.1.7",
+    "nanoid": "^6.0.0",
     "picocolors": "^1.1.1",
     "source-map-js": "^1.2.1"
   },
@@ -93,14 +93,14 @@
   "depup": {
     "changes": {
       "nanoid": {
-        "from": "^3.3.11",
-        "to": "^5.1.7"
+        "from": "^3.3.16",
+        "to": "^6.0.0"
       }
     },
     "depsUpdated": 1,
     "originalPackage": "postcss",
-    "originalVersion": "8.5.9",
-    "processedAt": "2026-04-08T00:42:19.576Z",
+    "originalVersion": "8.5.22",
+    "processedAt": "2026-07-22T08:55:34.234Z",
     "smokeTest": "passed"
   }
 }