fix(deps): update postcss ecosystem (spectrum-two) (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
postcss-licensing	3.0.0 → 5.0.0
postcss-modules	6.0.1 → 9.0.0
postcss-preset-env (source)	10.6.1 → 11.3.2
postcss-sorting	9.1.0 → 10.0.0
postcss-values-parser	6.0.2 → 8.0.0

---

Release Notes

castastrophe/postcss-licensing (postcss-licensing)

v5.0.0

Compare Source

• feat(deps)!: update node.js to v24 (#​157) (ab348f3)

BREAKING CHANGES

• Upgraded node support from v22 to v24.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@​users.noreply.github.com>

v4.0.0

Compare Source

• feat(deps)!: update node.js to v24 (#​157) (1c3bbe5)

BREAKING CHANGES

• Upgraded node support from v22 to v24.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@​users.noreply.github.com>

css-modules/postcss-modules (postcss-modules)

v9.0.0

Compare Source

Breaking

• Minimum Node.js bumped from 20 to 20.6, the release that stabilized module.register.

Added

• New postcss-modules/loader subpath — an opt-in Node module-customization hook. Run with node --import postcss-modules/loader app.mjs and JavaScript files can do import styles from "./button.css" to receive the class-name token map as the default export, mirroring css-loader's modules workflow. Options live in postcss-modules.config.{js,cjs,mjs} in cwd, the POSTCSS_MODULES_CONFIG env var, or a "postcss-modules" key in package.json, and accept the same shape as the PostCSS plugin. Aimed at non-bundler use cases (SSR, Node scripts, Jest/Vitest in node mode); bundler users keep using their existing integrations. #​80

v8.3.1

Compare Source

Fixed

• hashPrefix is now applied when no custom generateScopedName is set. Previously the option was only honoured by generic-names, so the built-in default generator silently ignored it. #​160
• Empty rules left behind after :global { ... } unwrapping (e.g. a Sass block containing only a multi-line comment) are now removed instead of emitted as orphaned { ... } blocks. #​136

v8.3.0

Compare Source

Added

• New localsConvention value 'all' — emit the original class name plus the camelCase and dashes-camelCase variants in one pass.
• New localsConvention value 'none' — emit only the original class name, with no additional aliases.
• The function form of localsConvention may now return an array of strings. Every entry in the array is added to the locals map and resolves to the same value, which makes it easy to expose a single CSS class under multiple JS-friendly aliases.

Adapted from the unmerged work in #​154 by @​CarbonORM.

v8.1.0

Compare Source

Internal

• Replaced Babel with swc across the entire toolchain: @swc/cli compiles src/ to build/, @swc/jest transforms test files, and ESLint now uses its default espree parser. Removed five @babel/* devDependencies and the unused @babel/register runtime hook. The published build/*.js keeps the same module.exports = (opts) => ...; module.exports.postcss = true shape, so existing CommonJS consumers are unaffected.
• Pinned transitive file-type to v22 via overrides to silence @swc/cli's vulnerable dependency chain.

v7.0.0

Compare Source

Breaking

• Dropped support for Node.js 10, 12, 14, and 15. The minimum supported Node.js version is now 18.

Security

• Patched 14 Dependabot security alerts in transitive dependencies (form-data, lodash, @babel/core, @babel/plugin-transform-modules-systemjs, uuid, picomatch, flatted, minimatch, qs, js-yaml, nanoid)
• Bumped jest from 26 to 30 to drop vulnerable node-notifier, sane, and jsdom chains

Internal

• Regenerated Jest snapshots for the new pretty-format serializer (cosmetic only; emitted CSS and JSON are unchanged)

csstools/postcss-plugins (postcss-preset-env)

v11.3.2

Compare Source

June 28, 2026

• Updated @csstools/css-color-parser to 4.1.9 (patch)
• Updated @csstools/postcss-progressive-custom-properties to 5.1.1 (patch)

v11.3.1

Compare Source

June 14, 2026

• Updated @csstools/css-color-parser to 4.1.7 (patch)

v11.3.0

Compare Source

May 13, 2026

• Added @csstools/postcss-container-rule-prelude-list Check the plugin README for usage details.
• Added @csstools/postcss-image-function Check the plugin README for usage details.
• Updated cssdb to 8.9.0

v11.2.1

Compare Source

April 12, 2026

• Updated @csstools/css-color-parser to 4.1.0 (minor)
• Updated @csstools/css-calc to 3.2.0 (minor)

v11.2.0

Compare Source

February 21, 2026

• Added @csstools/postcss-font-width-property Check the plugin README for usage details.
• Updated cssdb to 8.8.0

v11.1.3

Compare Source

February 6, 2026

• Updated @csstools/postcss-text-decoration-shorthand to 5.0.2 (patch)

v11.1.2

Compare Source

January 25, 2026

• Updated @csstools/postcss-normalize-display-values to 5.0.1 (patch)
• Updated @csstools/color-helpers to 6.0.1 (patch)

v11.1.1

Compare Source

January 15, 2026

• Updated @csstools/postcss-alpha-function to 2.0.1 (patch)

v11.1.0

Compare Source

January 14, 2026

• Added @csstools/postcss-mixins Check the plugin README for usage details.
• Updated cssdb to 8.7.0

v11.0.1

Compare Source

January 14, 2026

• Updated css-blank-pseudo to 8.0.1 (patch)

v11.0.0

Compare Source

January 14, 2026

• Updated: Support for Node 20.19.0 or later (major).
• Removed: commonjs API. In supported Node versions require(esm) will work without needing to make code changes.

hudochenkov/postcss-sorting (postcss-sorting)

v10.0.0

Compare Source

• Added limited sorting for properties in CSS-in-JS rules containing interpolation. Previosly such rules were ignored, now groups of properties are sorted. See example in the readme.
• Removed code needed for @stylelint/postcss-css-in-js syntax

shellscape/postcss-values-parser (postcss-values-parser)

v8.0.0

Compare Source

v7.0.1

Compare Source

v7.0.0

Compare Source

7.0.0

Highlights

• Major rewrite: parser now builds on css-tree for correctness and performance.
• Package is pure ESM and uses exports; no CommonJS output.
• Walker helpers are exposed via registerWalkers() and can enable walk* methods like walkWords.

Breaking changes

• ESM‑only: require('postcss-values-parser') is no longer supported. Use import.
• Node.js 20.19+ required (per engines).
• Walker helpers aren’t attached by default. If you relied on root.walkWords(...) in v6, call registerWalkers(Container) once to add the walk* methods.
• Internal AST is compatible but not identical (migrated to css-tree under the hood). Class names like Word, Numeric, Func, etc., remain.

Migration

• Replace CommonJS with ESM imports.

• Register walker helpers before using any walk* APIs:

  import { parse, Container, registerWalkers } from 'postcss-values-parser';
  registerWalkers(Container);

  const root = parse('var(--foo)');
  root.walkWords((word) => {
  if (word.isVariable) console.log(word.value);
  });

• Review docs for updated node shapes and stringifier behavior.

Commits since v6.0.2

• 58c3ac0 feat!: use css-tree, rewrite package for ESM (#​149) — Andrew Powell
• 1d367aa docs: update docs for v7 — shellscape
• c8b1647 chore: add github workflows — shellscape
• b19c7eb chore: use nvmrc — shellscape

Merged pull requests

• #​149 use css-tree, rewrite package for ESM — Andrew Powell

Full Changelog: shellscape/postcss-values-parser@v6.0.2...v7.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: b7f1d59

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cdransf]