chore(deps): bump postcss from 8.5.12 to 8.5.23 in /test-projects/expo-purchasely-test

[dependabot]

Bumps postcss from 8.5.12 to 8.5.23.

Release notes

Sourced from postcss's releases.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

Changelog

Sourced from postcss's changelog.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

... (truncated)

Commits

• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[greptile-apps]

PR author is in the excluded authors list.

[macminisupport]

Automated Dependabot review (2026-07-26) — research only, no merge/approve action taken.

Patch bump (8.5.12 → 8.5.23), test-projects/expo-purchasely-test. Changelog across 8.5.13→8.5.23 is bugfixes plus a security-hardening item (source maps no longer load without opts.from) — no breaking API changes documented.

CI: build-ios failed on this PR while every other job passed, including the parallel build-rn-0-86-ios job on the same commit — an inconsistent signature that's worth a look at the actual job log (https://github.com/Purchasely/Purchasely-ReactNative/actions/runs/30174869628/job/89721912754) before assuming it's a real regression from a CSS-tooling patch bump vs. a flake. Not auto-merging pending that check. No hold label, no merge conflicts.

Note: issues are disabled on this repo, so this review is posted as PR comments (see also #267, #266, #268, #265, #264) rather than a single tracking issue.

@kherembourg — could you glance at the build-ios failure log linked above? If it's unrelated/flaky this is otherwise a clean patch bump.

Related: #267, #266, #268, #265, #264

---

Generated by Claude Code

[macminisupport]

Dependabot review cycle summary for all 6 open dependency PRs (this one included) posted on #264 (GitHub Issues is disabled on this repo, so that PR hosts the tracking summary): #264 (comment)

This PR: postcss 8.5.12 → 8.5.23 (patch). ⚠️ build-ios check failed — worth investigating before merge. Waiting on @kherembourg confirmation before any merge/rebase action.

---

Generated by Claude Code

[macminisupport]

Automated Dependabot review — CI failing, awaiting confirmation

Note: this repo has Issues disabled, so a tracking issue could not be created for this batch; posting status directly here and on #264 instead. The other 4 open Dependabot PRs in this batch (#265, #266, #267, #268 — all minor/patch bumps with green CI) were already approved and merged.

This PR bumps postcss (used only in test-projects/expo-purchasely-test) from 8.5.12 to 8.5.23 — a patch bump with no breaking changes in the changelog. However, its CI run has a failing build-ios check while every other job (build-android, test, lint, iOS unit tests, build-rn-0-86-android/ios) passed. Given this is an unrelated dev-dependency bump inside a test project, this looks like a likely flaky/unrelated iOS build issue rather than something caused by the postcss bump itself, but it hasn't been re-run or investigated.

Reply here to confirm: should this be investigated, re-run, or skipped/closed?

---

Generated by Claude Code

[macminisupport]

Automated Dependabot review (2026-07-31) — research only, no merge/approve action taken.

Note: Issues are disabled on this repo, so this status is posted as a PR comment (as in prior cycles).

Only 1 open Dependabot PR currently: this one. Unchanged from the prior cycle — postcss 8.5.12 → 8.5.23 (patch), changelog is bugfixes + a security hardening item, no breaking changes. CI: build-ios still failing while every other job (including the parallel build-rn-0-86-ios on the same commit) passes — still unresolved whether this is a real regression or a flake pending @kherembourg's look at the job log. No hold label, no merge conflicts. Not merging pending that check.

---

Generated by Claude Code

[macminisupport]

Automated Dependabot review (2026-08-01) — unchanged, research only.

Still the only open Dependabot PR in this repo. No change from the prior cycle: postcss 8.5.12 → 8.5.23 (patch), no breaking changes in the changelog. CI: build-ios still the lone failure while every other job (including the parallel build-rn-0-86-ios job on the same commit) passes — still unresolved whether this is a real regression or a flake. No hold label, no merge conflicts. Not merging pending a look at that job log.

@kherembourg — still waiting on a look at the build-ios failure log (linked in the 2026-07-26 comment above) whenever you have a moment; otherwise this is a clean patch bump ready to go.

---

Generated by Claude Code

[macminisupport]

Dependabot PR Review — 2026-08-04 (research only — no merge/approve/close action taken)

Note: Issues are disabled on this repo (confirmed via API: 410 Issues has been disabled in this repository), so — following the precedent set in earlier review cycles on this PR — this tracking summary is posted as a PR comment rather than a GitHub issue.

All 4 currently open Dependabot PRs are scoped to test-projects/expo-purchasely-test only (no published SDK package is touched).

#	Package	Version Change	Bump	CI	Action
#273	undici	8.5.0 → 8.10.0	minor	❌ build-ios failing (6/7 green)	CI Failing — hold
#272	fast-uri	4.1.1 → 4.1.2	patch	❌ build-ios failing (6/7 green)	CI Failing — hold
#271	brace-expansion	1.1.14 → 1.1.18	patch	❌ build-ios failing (6/7 green)	CI Failing — hold
#269 (this PR)	postcss	8.5.12 → 8.5.23	minor	❌ build-ios failing (6/7 green)	CI Failing — hold

None are conflicting (mergeable_state is blocked on all four, not dirty) — no ·@·d·ependabot r·ebase was requested on any of them. None carry a hold label. None qualify for auto-merge since all four have a failing required check.

Notable pattern: all four fail the exact same single check — build-ios — while every other job, including the parallel build-rn-0-86-ios job on the same commit, passes. Since this identical signature shows up across four unrelated dependency bumps, it looks like a systemic/flaky build-ios issue rather than a regression caused by any one of these bumps — but per this PR's own multi-cycle comment history (2026-07-26 → 2026-08-01), that still hasn't been confirmed one way or the other.

@kherembourg (top recent human contributor on this repo's default branch) — flagging for visibility, per this PR's repeated prior asks about the build-ios failure log.

Nothing merges until a human comments approval or an override here.

---

Automated Dependabot review — no merge/approve action taken.

---

Generated by Claude Code

[macminisupport]

Dependabot PR Review — first pass (2026-08-08)

Note: GitHub Issues are disabled on this repo, so this tracking note is posted here instead of a dedicated issue. Cross-linked from #271, #272, #273, #274.

5 open Dependabot PRs, all npm/javascript. Nothing merges until a human comments approval/overrides here.

#	Package	Version Change	Bump	CI	Action
#274	undici (root package.json)	7.28.0 → 7.29.0	minor	🔴 Red — all 7 checks failed (lint, test, build-ios, build-android, build-rn-0-86-ios/android, iOS Unit Tests)	CI Failing — broad break tied to this bump itself, needs investigation before merge
#273	undici (/test-projects/expo-purchasely-test)	8.5.0 → 8.10.0	minor	🔴 Red — 6/7 pass, only build-ios fails	CI Failing — see build-ios note below
#272	fast-uri (/test-projects/expo-purchasely-test)	4.1.1 → 4.1.2	patch	🔴 Red — 6/7 pass, only build-ios fails	CI Failing — same build-ios pattern
#271	brace-expansion (/test-projects/expo-purchasely-test)	1.1.14 → 1.1.18	patch (likely GHSA-mh99-v99m-4gvg ReDoS backport)	🔴 Red — 6/7 pass, only build-ios fails	CI Failing — same build-ios pattern, otherwise a safe security patch
#269 (this PR)	postcss (/test-projects/expo-purchasely-test)	8.5.12 → 8.5.23	patch	🔴 Red — 6/7 pass, only build-ios fails	CI Failing — same build-ios pattern

No majors — all 5 confirmed patch/minor from the actual version numbers, so no changelog deep-dive was needed for breaking changes.

#273 vs #274 (undici) — not duplicates: #274 targets the root package.json's undici@7.x line; #273 explicitly targets /test-projects/expo-purchasely-test's independent undici@8.x line. Two separate manifests, correctly split by Dependabot.

Notable pattern: all four /test-projects/expo-purchasely-test PRs (#269, #271, #272, #273) fail on the same single check — build-ios — while every other check (lint, test, android, iOS unit tests) passes on each. Worth confirming whether build-ios is already broken on main independent of these bumps (pre-existing/flaky) rather than caused by any individual dependency. #274 is the outlier with all 7 checks red, suggesting a more direct break from the root undici 7.29.0 bump itself.

Checked per PR: CI via check runs, mergeable_state (all blocked — branch-protection/required-review gating, none dirty, so no conflicts and no ·@·d·ependabot r·ebase needed), and labels (dependencies + javascript only — no hold labels on any of the 5).

Next step

@kherembourg (most recently active human contributor found in this repo's commit history) — could you comment here with an explicit go-ahead or overrides once the build-ios failures are triaged? Given all 5 are currently CI-red, none are auto-merge candidates yet; recommend investigating whether build-ios is broken on main first, since that would explain 4 of the 5 failures and unblock #269/#271/#272/#273 once fixed (#271's brace-expansion patch looks like the highest-value one to land, if it is indeed the known ReDoS backport). #274 likely needs separate investigation given it fails everything.

Nothing in this list merges without an explicit human go-ahead comment here.

---

Generated by Claude Code

[macminisupport]

Dependabot PR Review — 2026-08-09 (tracking)

GitHub Issues remain disabled on this repo (confirmed again via API: 410 Issues has been disabled in this repository), so — per the precedent set on this PR in every prior cycle — this tracking note lives here as a PR comment, assigned to @kherembourg and labeled dependabot-review, and doubles as the tracking record. Cross-linked from #271, #272, #273, #274.

5 open Dependabot PRs, all npm/javascript. Nothing merges, gets approved, or gets closed until a human posts an explicit go-ahead comment here.

#	Package	Version Change	Bump	CI	Action
#274	undici (root package.json)	7.28.0 → 7.29.0	minor	🔴 All 7 checks failing (lint, test, build-ios, build-android, build-rn-0-86-ios/android, iOS Unit Tests)	Hold — CI red across the board
#273	undici (/test-projects/expo-purchasely-test)	8.5.0 → 8.10.0	minor	🔴 6/7 green — only build-ios fails	Hold — pending build-ios triage
#272	fast-uri (/test-projects/expo-purchasely-test)	4.1.1 → 4.1.2	patch (security: GHSA-7p8r-x3mc-p8w7)	🔴 6/7 green — only build-ios fails	Hold — pending build-ios triage
#271	brace-expansion (/test-projects/expo-purchasely-test)	1.1.14 → 1.1.18	patch (likely ReDoS backport, v1.1.15)	🔴 6/7 green — only build-ios fails	Hold — pending build-ios triage
#269 (this PR)	postcss (/test-projects/expo-purchasely-test)	8.5.12 → 8.5.23	patch (corrected — major.minor unchanged at 8.5, only the patch digit moved)	🔴 6/7 green — only build-ios fails	Hold — pending build-ios triage

Bump classification: No majors. All 5 verified via semver against the version numbers in the titles, so no changelog deep-dive was needed for breaking-change risk. fast-uri 4.1.2 and brace-expansion 1.1.15+ each carry an upstream security advisory even though both are low-risk patches.

#273 vs #274 (undici) are not duplicates: #274 targets the root package.json's undici@7.x line; #273 targets /test-projects/expo-purchasely-test's independent undici@8.x line — two separate manifests, correctly split by Dependabot.

Hold labels / conflicts: None found. All 5 PRs carry only dependencies + javascript — no do-not-merge/hold/wip label on any. mergeable_state is blocked (branch-protection gating on required checks/reviews) on all 5, not dirty — so there are no real merge conflicts and no ·@·d·ependabot r·ebase comment was needed on any PR this cycle.

Human comments: None found on any of the 5 PRs this cycle — only bot comments (greptile-apps' auto-excluded note, and this account's own prior review-cycle comments).

Risk assessment: All 4 /test-projects/expo-purchasely-test PRs (#269, #271, #272, #273) fail on the exact same single check, build-ios, while every other job (lint, test, build-android, iOS Unit Tests, both build-rn-0-86-* jobs) passes on each. That recurring signature across four unrelated dependency bumps suggests a systemic/flaky build-ios issue — quite possibly already broken on main — rather than a regression from any one of these bumps, though that still hasn't been confirmed against the job logs (this has been an open question on this PR since 2026-07-26). #274 is the outlier: it fails all 7 checks, pointing to a more direct break tied specifically to the root undici 7.29.0 bump, and likely needs separate investigation from the other four.

Suggested merge order once CI is green (safest/greenest first): #271 (brace-expansion, patch/security) → #272 (fast-uri, patch/security) → #269 (postcss, patch) → #273 (undici test-projects, minor) → #274 (undici root, minor — investigate its full-suite failure independently first, since it's the one PR not explained by the shared build-ios pattern).

@kherembourg — assigning this to you as the most active recent contributor on main (25 of the last 30 commits). Whenever you get a chance: an explicit go-ahead comment here (or per-PR) is what unblocks any of these; also flagging the long-standing build-ios question above if you're able to check the job log.

---

Generated by Claude Code

[macminisupport]

Dependabot PR Review — 2026-08-10 (tracking)

GitHub Issues remain disabled on this repo, so — per the precedent set on this PR — this tracking note lives here as a PR comment. Cross-linked from #271, #272, #273, #274.

Fully unchanged from the 2026-08-09 cycle: same 5 open Dependabot PRs, no new commits, no re-triggered CI, no human comment on any of them since this review process started (2026-07-26 — 15 days, 8 review cycles, zero response).

#	Package	Version Change	Bump	CI	Action
#274	undici (root package.json)	7.28.0 → 7.29.0	minor	🔴 All 7 checks still failing	Hold — CI red across the board, needs its own investigation
#273	undici (/test-projects/expo-purchasely-test)	8.5.0 → 8.10.0	minor	🔴 6/7 green — only build-ios fails	Hold — pending build-ios triage
#272	fast-uri (/test-projects/expo-purchasely-test)	4.1.1 → 4.1.2	patch (security: GHSA-7p8r-x3mc-p8w7)	🔴 6/7 green — only build-ios fails	Hold — pending build-ios triage
#271	brace-expansion (/test-projects/expo-purchasely-test)	1.1.14 → 1.1.18	patch (likely ReDoS backport)	🔴 6/7 green — only build-ios fails	Hold — pending build-ios triage
#269 (this PR)	postcss (/test-projects/expo-purchasely-test)	8.5.12 → 8.5.23	patch	🔴 6/7 green — only build-ios fails	Hold — pending build-ios triage

No hold labels, no merge conflicts (mergeable_state: blocked on all 5, not dirty) — unchanged.

Standing question, now 15 days open: build-ios fails identically across 4 unrelated dependency bumps (#269, #271, #272, #273) while every other check passes on each — strong signal this is a pre-existing/flaky failure on main, not caused by any of these bumps. #274 remains the outlier with all 7 checks red, tied to the root undici 7.29.0 bump itself.

@kherembourg — still assigned as the most recently active contributor. An explicit go-ahead comment here (or per-PR) is what unblocks any of these; also still flagging the long-standing build-ios job-log question above.

Nothing merges, gets approved, or gets closed until a human posts an explicit comment here.

---

Generated by Claude Code

[dependabot]

Superseded by #276.