chore(deps-dev): bump postcss from 8.4.38 to 8.5.10 by dependabot[bot] · Pull Request #4689 · module-federation/core

dependabot · 2026-04-24T15:38:22Z

Bumps postcss from 8.4.38 to 8.5.10.

Release notes

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@romainmenke during his work on Stylelint added Input#document in additional to Input#css.
root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"
</tr></table>

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

Added Input#document for sources like CSS-in-JS or HTML (by @romainmenke).

8.4.49

Fixed custom syntax without source.offset (by @romainmenke).

... (truncated)

Commits

33b9790 Release 8.5.10 version
536c79e Escape </style> in CSS output (#2074)
afa96b2 Update dependencies (#2073)
effe88b Typo (#2072)
3ee79a2 Thread model (#2071)
2e0683d Create incident response docs (#2070)
fe88ac2 Release 8.5.9 version
c551632 Avoid RegExp when we can use simple JS
89a6b74 Move SECURITY.txt for docs folder to keep GitHub page cleaner
6ceb8a4 Create SECURITY.md
Additional commits viewable in compare view

changeset-bot · 2026-04-24T15:38:26Z

⚠️ No Changeset found

Latest commit: 1c91b9e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

netlify · 2026-04-24T15:38:27Z

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	`1c91b9e`
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/69f024993ba67c0008ce6287
😎 Deploy Preview	https://deploy-preview-4689--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

chatgpt-codex-connector · 2026-04-24T15:38:27Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

pkg-pr-new · 2026-04-24T15:42:22Z

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@1c91b9e

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@1c91b9e

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@1c91b9e

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@1c91b9e

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@1c91b9e

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@1c91b9e

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@1c91b9e

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@1c91b9e

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@1c91b9e

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@1c91b9e

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@1c91b9e

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@1c91b9e

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@1c91b9e

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@1c91b9e

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@1c91b9e

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@1c91b9e

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@1c91b9e

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@1c91b9e

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@1c91b9e

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@1c91b9e

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@1c91b9e

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@1c91b9e

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@1c91b9e

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@1c91b9e

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@1c91b9e

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@1c91b9e

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@1c91b9e

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@1c91b9e

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@1c91b9e

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@1c91b9e

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@1c91b9e

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@1c91b9e

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@1c91b9e

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@1c91b9e

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@1c91b9e

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@1c91b9e

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@1c91b9e

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@1c91b9e

commit: 1c91b9e

github-actions · 2026-04-24T15:43:14Z

Bundle Size Report

11 package(s) changed, 28 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
`@module-federation/cli`	26.3 kB	no change	786 B	no change
`@module-federation/core`	39.1 kB	no change	173 B	no change
`@module-federation/devtools`	487.9 kB	no change	3.9 kB	no change
`@module-federation/enhanced`	806.6 kB	no change	672 B	no change
`@module-federation/managers`	69.8 kB	no change	334 B	no change
`@module-federation/manifest`	136.1 kB	no change	182 B	no change
`@module-federation/metro-plugin-rnc-cli`	0 B	no change	314 B	no change
`@module-federation/node`	193.4 kB	no change	217 B	no change
`@module-federation/runtime-core`	252.7 kB	+8 B (+0.0%)	477 B	no change
`@module-federation/storybook-addon`	77.6 kB	no change	100 B	no change
`@module-federation/utilities`	110.6 kB	no change	328 B	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
`@module-federation/cli`	2.3 kB	-31 B (-1.3%)	2.3 kB	-31 B (-1.3%)
`@module-federation/core`	1.1 kB	-30 B (-2.7%)	1.0 kB	-29 B (-2.7%)
`@module-federation/devtools`	21.3 kB	-27 B (-0.1%)	21.3 kB	-27 B (-0.1%)
`@module-federation/enhanced`	2.6 kB	-43 B (-1.6%)	2.6 kB	-43 B (-1.6%)
`@module-federation/managers`	2.4 kB	-26 B (-1.0%)	2.4 kB	-26 B (-1.0%)
`@module-federation/manifest`	6.1 kB	-39 B (-0.6%)	6.1 kB	-39 B (-0.6%)
`@module-federation/metro-plugin-rnc-cli`	411 B	-25 B (-5.7%)	411 B	-25 B (-5.7%)
`@module-federation/node`	9.2 kB	-27 B (-0.3%)	9.2 kB	-27 B (-0.3%)
`@module-federation/runtime-core`	13.7 kB	no change	13.4 kB	no change
`@module-federation/storybook-addon`	1.9 kB	-23 B (-1.2%)	1.7 kB	-23 B (-1.3%)
`@module-federation/utilities`	2.6 kB	-31 B (-1.2%)	2.6 kB	-31 B (-1.2%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	19.7 kB	-14 B (-0.1%)	20.8 kB	-6 B (-0.0%)	+1.0 kB	+8 B

Total dist (raw): 6.20 MB (+8 B (+0.0%))
Total ESM gzip: 73.8 kB (no change)
Total web bundle (gzip): 177.5 kB (-302 B (-0.2%))
Total node bundle (gzip): 177.9 kB (-301 B (-0.2%))
Tracked ./bundler entry gzip: 556 B (no change)
Tracked ./bundler web bundle (gzip): 4.8 kB (no change)
Tracked ./bundler node bundle (gzip): 4.8 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.

Bumps [postcss](https://github.com/postcss/postcss) from 8.4.38 to 8.5.10. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.38...8.5.10) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 24, 2026

dependabot Bot changed the title ~~chore(deps-dev): bump postcss from 8.4.49 to 8.5.10~~ chore(deps-dev): bump postcss from 8.4.38 to 8.5.10 Apr 28, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/postcss-8.5.10 branch from 0d3ef1b to 6fc3a08 Compare April 28, 2026 02:59

dependabot Bot force-pushed the dependabot/npm_and_yarn/postcss-8.5.10 branch from 6fc3a08 to 1c91b9e Compare April 28, 2026 03:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump postcss from 8.4.38 to 8.5.10#4689

chore(deps-dev): bump postcss from 8.4.38 to 8.5.10#4689
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/postcss-8.5.10

dependabot Bot commented on behalf of github Apr 24, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Apr 24, 2026

Uh oh!

pkg-pr-new Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.3

8.5.2

8.5.1

8.5 “Duke Alloces”

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.3

8.5.2

8.5.1

8.5 “Duke Alloces”

8.4.49

Uh oh!

changeset-bot Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

netlify Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for module-federation-docs ready!

Uh oh!

chatgpt-codex-connector Bot commented Apr 24, 2026

Uh oh!

pkg-pr-new Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle Size Report

Package dist + ESM entry

Bundle targets

Consumer scenarios

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 24, 2026 •

edited

Loading

changeset-bot Bot commented Apr 24, 2026 •

edited

Loading

netlify Bot commented Apr 24, 2026 •

edited

Loading

pkg-pr-new Bot commented Apr 24, 2026 •

edited

Loading

github-actions Bot commented Apr 24, 2026 •

edited

Loading