Bump postcss, @angular-builders/custom-webpack and @angular-devkit/build-angular by dependabot[bot] · Pull Request #193 · capitalone/acronym-decoder

dependabot · 2026-08-05T08:27:18Z

Bumps postcss to 8.5.25 and updates ancestor dependencies postcss, @angular-builders/custom-webpack and @angular-devkit/build-angular. These dependencies need to be updated together.

Updates postcss from 8.5.6 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

... (truncated)

Commits

08c989c Release 8.5.25 version
24f6814 Fix 8.5.17 visitor regression
f2fa53f Add supply chain security requirement to PostCSS plugin guide
10edf0b fix: return empty array for empty string in list.split (#2121)
0ebe8ad Release 8.5.24 version
73218c6 Update dependencies
9a114f6 Preserve the BOM when stringifying (#2119)
9069261 Fix types check
eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates @angular-builders/custom-webpack from 19.0.1 to 22.0.1

Changelog

Sourced from @angular-builders/custom-webpack's changelog.

22.0.1 (2026-06-23)

Note: Version bump only for package @angular-builders/custom-webpack

22.0.1-beta.0 (2026-06-22)

Note: Version bump only for package @angular-builders/custom-webpack

22.0.0 (2026-06-10)

Note: Version bump only for package @angular-builders/custom-webpack

22.0.0-beta.1 (2026-06-09)

Note: Version bump only for package @angular-builders/custom-webpack

22.0.0-beta.0 (2026-06-09)

⚠ BREAKING CHANGES

All packages now require Angular 22.

User TypeScript config/plugin modules now load via jiti instead of ts-node. Configs are transpiled rather than type-checked (run tsc --noEmit separately if you relied on build-time type-checking); ts-node and tsconfig-paths are no longer dependencies; and the NODE_OPTIONS='--loader ts-node/esm' workaround for ESM apps is no longer needed.

Features

ng add / ng update schematics for jest, custom-esbuild, custom-webpack (#2267) (062f423), closes #22

replace ts-node with jiti for loading TypeScript modules (#2287) (0348e06), closes #816

upgrade builders + examples to Angular 22 (22.0.0-rc.2) (#2264) (9ed7020)

Miscellaneous Chores

graduate Angular 22 from RC to GA (daec882)

21.1.0 (2026-06-08)

Note: Version bump only for package @angular-builders/custom-webpack

21.1.0-beta.13 (2026-06-05)

Reverts

remove redundant TS2742 builder annotations (#2275, #2278) (#2279) (a2882e5)

21.1.0-beta.12 (2026-06-04)

Bug Fixes

builders: annotate builder default exports with Builder to avoid TS2742 (#2278) (7db3848)

21.1.0-beta.11 (2026-06-01)

... (truncated)

Commits

0a130ae ci(release): publish
79b145a ci(release): publish
6cdd684 style: format repo with prettier and add CI format gate (#2323)
7cebff9 ci(release): publish
6647e73 ci(release): publish
49f90e4 docs(changelog): clean up v22 breaking-change sections
a27c6b0 ci(release): publish
daec882 chore!: graduate Angular 22 from RC to GA
2cb9a56 chore(deps): update bazel-example to Angular CLI 22
0348e06 feat!: replace ts-node with jiti for loading TypeScript modules (#2287)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @angular-builders/custom-webpack since your current version.

Updates @angular-devkit/build-angular from 19.2.19 to 22.1.3

Release notes

Sourced from @angular-devkit/build-angular's releases.

22.1.3

@angular/cli

Commit Description

always install package during ng add to inspect manifest on disk for schematics (#33718)

correctly report available package updates during bare ng update

discover migrations from installed packages when omitted by registry metadata (#33718)

normalize Windows drive-letter casing for process.cwd

@angular/build

Commit Description

prevent build process hang on unhandled error (#33715)

retain watch files on error in load result cache

support case-insensitive and alternative license file names

release build resources early in non-watch mode (#33715)

@angular/ssr

Commit Description

settle writeResponseToNodeResponse when client disconnects

avoid buffering request body when sanitizing headers

22.1.2

@angular/cli

Commit Description

add packages with built-in schematics to devDependencies only

@angular/build

Commit Description

prevent IIFE wrapper interleaving for adjacent classes in minified files

22.1.1

@angular/cli

Commit Description

support npm 12 metadata array and error formats

@angular/build

Commit Description

rewrite paths from sandboxed execroots when running under Bazel

22.1.0

@angular/cli

Commit Description

abort and guide manual mitigation when updating catalog packages

prevent Yarn registry environment variable override

remove algoliasearch dependency and support latest docs versions

resolve correct registry name when using npm alias syntax during update

respect client-side release age settings during update resolution

... (truncated)

Changelog

Sourced from @angular-devkit/build-angular's changelog.

22.1.3 (2026-08-05)

@angular/cli

Commit Type Description

f837b788c6 fix always install package during ng add to inspect manifest on disk for schematics (#33718)

72ae93638d fix correctly report available package updates during bare ng update

a949e06568 fix discover migrations from installed packages when omitted by registry metadata (#33718)

1d9122fd50 fix normalize Windows drive-letter casing for process.cwd

@angular/build

Commit Type Description

a4860d505a fix prevent build process hang on unhandled error (#33715)

7686d66cab fix retain watch files on error in load result cache

25b7cf7504 fix support case-insensitive and alternative license file names

4fd81402ce perf release build resources early in non-watch mode (#33715)

@angular/ssr

Commit Type Description

6af906cb94 fix settle writeResponseToNodeResponse when client disconnects

917d3b2254 perf avoid buffering request body when sanitizing headers

21.2.20 (2026-08-05)

@angular-devkit/build-angular

Commit Type Description

972f6db7e9 fix upgrade postcss to 8.5.23

@angular/build

Commit Type Description

8de75ada50 fix upgrade postcss to 8.5.23

20.3.33 (2026-08-05)

... (truncated)

Commits

60078fc release: cut the v22.1.3 release
434e070 refactor(@angular/cli): remove unused eslint-disable comment in git utility
3a49bd4 build: update pnpm to v11.20.0
7686d66 fix(@angular/build): retain watch files on error in load result cache
1d9122f fix(@angular/cli): normalize Windows drive-letter casing for process.cwd
4e54f3a ci: schedule ng-snapshot Renovate updates for early morning only
6f75b73 build: update cross-repo angular dependencies
25b7cf7 fix(@angular/build): support case-insensitive and alternative license file names
212373a build: lock file maintenance
74d6d0b build: update dependency postcss to v8.5.25
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

…ild-angular Bumps [postcss](https://github.com/postcss/postcss) to 8.5.25 and updates ancestor dependencies [postcss](https://github.com/postcss/postcss), [@angular-builders/custom-webpack](https://github.com/just-jeb/angular-builders/tree/HEAD/packages/custom-webpack) and [@angular-devkit/build-angular](https://github.com/angular/angular-cli). These dependencies need to be updated together. Updates `postcss` from 8.5.6 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.25) Updates `@angular-builders/custom-webpack` from 19.0.1 to 22.0.1 - [Release notes](https://github.com/just-jeb/angular-builders/releases) - [Changelog](https://github.com/just-jeb/angular-builders/blob/master/packages/custom-webpack/CHANGELOG.md) - [Commits](https://github.com/just-jeb/angular-builders/commits/@angular-builders/custom-webpack@22.0.1/packages/custom-webpack) Updates `@angular-devkit/build-angular` from 19.2.19 to 22.1.3 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@19.2.19...v22.1.3) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect - dependency-name: "@angular-builders/custom-webpack" dependency-version: 22.0.1 dependency-type: direct:development - dependency-name: "@angular-devkit/build-angular" dependency-version: 22.1.3 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

CLAassistant · 2026-08-05T08:27:28Z

All committers have signed the CLA.

sonarqubecloud · 2026-08-05T08:27:42Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

socket-security · 2026-08-05T08:29:48Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
@angular-devkit/build-angular@19.2.19 ⏵ 22.1.3	^-1			⁺¹
webpack@5.99.9 ⏵ 5.109.2	^-13	⁺²	⁺¹	⁺¹
@angular-builders/custom-webpack@19.0.1 ⏵ 22.0.1			⁺¹

View full report

socket-security · 2026-08-05T08:29:50Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@emnapi/runtime` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@angular-builders/custom-webpack@22.0.1` → `npm/@angular-devkit/build-angular@22.1.3` → `npm/@emnapi/runtime@1.11.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `lmdb` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@angular-builders/custom-webpack@22.0.1` → `npm/@angular-devkit/build-angular@22.1.3` → `npm/lmdb@3.5.6` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/lmdb@3.5.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `typescript` License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: package-lock.json → `npm/@angular-builders/custom-webpack@22.0.1` → `npm/typescript@6.0.3` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@6.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `webpack` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/webpack@5.109.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/webpack@5.109.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 5, 2026

dependabot Bot requested review from a team as code owners August 5, 2026 08:27

github-actions Bot enabled auto-merge (squash) August 5, 2026 08:27

amadib approved these changes Aug 17, 2026

View reviewed changes

github-actions Bot merged commit 581a978 into master Aug 22, 2026
8 of 10 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/multi-a733737445 branch August 22, 2026 02:13

Navigation Menu

Uh oh!

Bump postcss, @angular-builders/custom-webpack and @angular-devkit/build-angular - #193

Bump postcss, @angular-builders/custom-webpack and @angular-devkit/build-angular#193
github-actions[bot] merged 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-a733737445

dependabot Bot commented on behalf of github Aug 5, 2026

Uh oh!

CLAassistant commented Aug 5, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Aug 5, 2026

Uh oh!

socket-security Bot commented Aug 5, 2026

Uh oh!

socket-security Bot commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Commit	Description
	always install package during ng add to inspect manifest on disk for schematics (#33718)
	correctly report available package updates during bare ng update
	discover migrations from installed packages when omitted by registry metadata (#33718)
	normalize Windows drive-letter casing for process.cwd

Commit	Description
	prevent build process hang on unhandled error (#33715)
	retain watch files on error in load result cache
	support case-insensitive and alternative license file names
	release build resources early in non-watch mode (#33715)

Commit	Description
	settle writeResponseToNodeResponse when client disconnects
	avoid buffering request body when sanitizing headers

Commit	Description
	abort and guide manual mitigation when updating catalog packages
	prevent Yarn registry environment variable override
	remove algoliasearch dependency and support latest docs versions
	resolve correct registry name when using npm alias syntax during update
	respect client-side release age settings during update resolution

Commit	Type	Description
f837b788c6	fix	always install package during ng add to inspect manifest on disk for schematics (#33718)
72ae93638d	fix	correctly report available package updates during bare ng update
a949e06568	fix	discover migrations from installed packages when omitted by registry metadata (#33718)
1d9122fd50	fix	normalize Windows drive-letter casing for process.cwd

Commit	Type	Description
a4860d505a	fix	prevent build process hang on unhandled error (#33715)
7686d66cab	fix	retain watch files on error in load result cache
25b7cf7504	fix	support case-insensitive and alternative license file names
4fd81402ce	perf	release build resources early in non-watch mode (#33715)

Commit	Type	Description
6af906cb94	fix	settle writeResponseToNodeResponse when client disconnects
917d3b2254	perf	avoid buffering request body when sanitizing headers

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 5, 2026

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

22.0.1 (2026-06-23)

22.0.1-beta.0 (2026-06-22)

22.0.0 (2026-06-10)

22.0.0-beta.1 (2026-06-09)

22.0.0-beta.0 (2026-06-09)

⚠ BREAKING CHANGES

Features

Miscellaneous Chores

21.1.0 (2026-06-08)

21.1.0-beta.13 (2026-06-05)

Reverts

21.1.0-beta.12 (2026-06-04)

Bug Fixes

21.1.0-beta.11 (2026-06-01)

22.1.3

@​angular/cli

@​angular/build

@​angular/ssr

22.1.2

@​angular/cli

@​angular/build

22.1.1

@​angular/cli

@​angular/build

22.1.0

@​angular/cli

22.1.3 (2026-08-05)

@​angular/cli

@​angular/build

@​angular/ssr

21.2.20 (2026-08-05)

@​angular-devkit/build-angular

@​angular/build

20.3.33 (2026-08-05)

Uh oh!

CLAassistant commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Aug 5, 2026

Quality Gate passed

Uh oh!

socket-security Bot commented Aug 5, 2026

Uh oh!

socket-security Bot commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

`@angular/cli`

`@angular/build`

`@angular/ssr`

`@angular/cli`

`@angular/build`

`@angular/cli`

`@angular/build`

`@angular/cli`

`@angular/cli`

`@angular/build`

`@angular/ssr`

`@angular-devkit/build-angular`

`@angular/build`

CLAassistant commented Aug 5, 2026 •

edited

Loading