chore(deps): bump the npm_and_yarn group across 1 directory with 1 update

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: postcss.

Updates postcss from 8.5.22 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

Changelog

Sourced from postcss's changelog.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

Commits

• 08c989c Release 8.5.25 version
• 24f6814 Fix 8.5.17 visitor regression
• f2fa53f Add supply chain security requirement to PostCSS plugin guide
• 10edf0b fix: return empty array for empty string in list.split (#2121)
• 0ebe8ad Release 8.5.24 version
• 73218c6 Update dependencies
• 9a114f6 Preserve the BOM when stringifying (#2119)
• 9069261 Fix types check
• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• Additional commits viewable in compare view

Updates postcss from 8.5.22 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

Changelog

Sourced from postcss's changelog.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

Commits

• 08c989c Release 8.5.25 version
• 24f6814 Fix 8.5.17 visitor regression
• f2fa53f Add supply chain security requirement to PostCSS plugin guide
• 10edf0b fix: return empty array for empty string in list.split (#2121)
• 0ebe8ad Release 8.5.24 version
• 73218c6 Update dependencies
• 9a114f6 Preserve the BOM when stringifying (#2119)
• 9069261 Fix types check
• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 039034e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Package Artifacts

Built from 3c16506. Download artifacts from this workflow run.

JS SDK (e2b@2.38.2-dependabot-npm-and-yarn-npm-and-yarn-69f37c81ac.0):

npm install ./e2b-2.38.2-dependabot-npm-and-yarn-npm-and-yarn-69f37c81ac.0.tgz

CLI (@e2b/cli@2.16.2-dependabot-npm-and-yarn-npm-and-yarn-69f37c81ac.0):

npm install ./e2b-cli-2.16.2-dependabot-npm-and-yarn-npm-and-yarn-69f37c81ac.0.tgz

Python SDK (e2b==2.37.1+dependabot.npm.and.yarn.npm.and.yarn.69f37c81ac):

pip install ./e2b-2.37.1+dependabot.npm.and.yarn.npm.and.yarn.69f37c81ac-py3-none-any.whl

[claude]

LGTM — mechanical dependency bump with no source changes.

What was reviewed: this is a Dependabot lockfile-only PR bumping postcss (8.5.22 → 8.5.26) and its transitive dependency resolutions (rollup, nanoid, acorn). No application source files are touched, and the version diffs match the changelog entries (bug fixes and a security hardening note about source maps requiring opts.from).

Extended reasoning...

Overview

The only changed file is pnpm-lock.yaml. This is an automated Dependabot PR bumping the postcss package from 8.5.22 to 8.5.26 within the npm_and_yarn dependency group, along with the transitive lockfile updates this pulls in (rollup 4.62.2→4.62.4, acorn 8.17.0→8.18.0, nanoid 3.3.16→3.3.17, plus a new optional @napi-rs/lzma-linux-x64-gnu optional dependency of rollup). No application code, config, or build scripts are modified.

Security risks

None identified. postcss is a build-time CSS transform tool, not used in any runtime/production request path in this repo. The upstream changelog actually includes a security-hardening fix (postcss now refuses to load a source map without opts.from), so this is a net-positive change from a security posture standpoint. No new packages are being newly introduced into the dependency tree beyond transitive optional native bindings for rollup, which is expected behavior for a rollup point release.

Level of scrutiny

Low. This is a routine, bot-generated patch-level dependency bump confined entirely to a lockfile, with no hand-written code changes to review. This is exactly the kind of mechanical, low-ambiguity change that's safe to shadow-approve.

Other factors

No changeset is required since no publishable package source changed (only the lockfile). The bug-hunting system found no issues, and there are no unresolved comments in the PR timeline beyond the automated changeset-bot notice, which is expected/informational for lockfile-only changes.