chore(deps-dev): bump postcss from 8.5.15 to 8.5.23 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: postcss.

Updates postcss from 8.5.15 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Commits

• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d62f6dd32e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Update the Bun lockfile with the PostCSS bump

Changing the direct postcss devDependency without updating bun.lock leaves the workspace lock entry and package entry pinned to 8.5.15, so the committed dependency graph still does not contain 8.5.23. This breaks reproducible installs in contexts that use the lockfile strictly: .github/workflows/sync-infra-specs.yml runs bun install --frozen-lockfile, and bun install --help defines that flag as disallowing lockfile changes. Please regenerate and commit bun.lock alongside this manifest change.

Useful? React with 👍 / 👎.

[claude]

🔴 package.json now exact-pins postcss to 8.5.23, but bun.lock was not regenerated — it still records postcss@8.5.15 (workspace snapshot at line 101, resolved entry at line 1367). Since the lockfile no longer satisfies the exact package.json pin, bun install --frozen-lockfile (used in .github/workflows/sync-infra-specs.yml:65) will fail the next time that job runs. Please regenerate bun.lock (e.g. ·@·d·ependabot r·ecreate or bun install) alongside this bump.

Extended reasoning...

The bug

This is a dependency-bump PR that only touches package.json, changing the postcss devDependency pin from 8.5.15 to an exact 8.5.23 (no ^ range). Dependabot normally regenerates bun.lock in the same commit as a version bump so the lockfile and manifest stay in sync — that did not happen here.

Where it shows up

bun.lock still has the old version in two places:

• Line 101, inside the workspace package snapshot: "postcss": "8.5.15"
• Line 1367, the resolved package entry: "postcss": ["postcss@8.5.15", ...]

Since package.json now demands the exact string 8.5.23, and the lockfile only records 8.5.15, the two files disagree.

Why nothing today catches this

test.yml and code-quality.yml invoke plain bun install, which will silently rewrite bun.lock to match package.json and mask the drift — so CI on this PR itself stays green. The problem surfaces in .github/workflows/sync-infra-specs.yml:65, which runs bun install --frozen-lockfile. That flag makes bun refuse to modify the lockfile and instead hard-fail if the manifest and lockfile disagree.

Step-by-step proof

1. Merge this PR: package.json devDependencies now require postcss at exactly 8.5.23.
2. bun.lock is untouched, still resolving postcss@8.5.15 per lines 101 and 1367.
3. A later PR modifies a tracked OpenAPI spec file, satisfying the has_changes gate in sync-infra-specs.yml.
4. That workflow reaches its "Install dependencies" step (sync-infra-specs.yml:65): bun install --frozen-lockfile.
5. Bun compares the exact-pinned 8.5.23 requirement in package.json against the 8.5.15 entry frozen in bun.lock, finds a mismatch, and exits non-zero rather than touching the lockfile — the job fails.

Impact and fix

The immediate PR does not break merge-gating CI (which uses plain bun install), but it leaves the repo in a state where the very next spec-sync run breaks, and the failure is unrelated to whatever that PR actually changes — a confusing false-positive to debug later. The fix is trivial: regenerate bun.lock in this PR (e.g. comment ·@·d·ependabot r·ecreate, or run bun install locally and commit the updated lockfile) so both files agree on postcss@8.5.23.