npm / postcss
postcss
What changed in postcss 8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
2 breaking3 security2 new APIs and options4 performance31 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initpostcss 842 changes
Breaking changes 2
Source maps are no longer loaded unless opts.from is provided, preventing potentially unsafe source-map loading.
Previous source maps are restricted to the opts.from folder for security reasons.
Security 3
Fixed prototype hijacking when using postcss.fromJSON().
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
New APIs and options 2
Set unsafeMap to true to disable the previous source maps folder restriction.
Added opts.unsafeMap to disable checks.
Performance 4
Declaration parsing performance was fixed, improving how PostCSS processes declarations.
Improved performance when parsing nested brackets.
Speeds up source map encoding parsing when an error occurs.
Improved performance when cleaning source map annotations.
Fixes and other changes 31
Fixes broken source maps caused by escaping </style> in CSS.
Comments are now supported when using list.comma() and list.space().
Improved escaping of closing style tags.
Fixes a types regression.
Fixed removing comments starting with /*#.
Fixed handling of the * hack before a comment in Custom Properties.
Fixed Chinese text displayed in a deprecation warning.
Fixed empty values appearing in the middle of comma-separated lists.
Fixed handling of whitespace-only values in space-separated lists.
Fixed a rule's end position when a space appears before a semicolon.
Fixed type definitions.
Fixed a regression in list.split().
Source map loading now tracks symlinks in path protection.
Fixed list.split for non-string values.
Fixed a regression affecting visitors introduced in 8.5.17.
Preserves the BOM after processing.
Fixed custom properties losing their semicolon before a comment.
Fixed childless at-rules losing their semicolon before a comment during processing.
Fixed a missing space when AtRule#params is set after.
Fixed a mixing AST error that occurred on warnings.
Fixed cleaning before for new nodes inserted to Root.
Fixed Input#origin() behavior for unmapped end positions.
Fixed an error that could exceed the maximum call stack size.
Fixed the position returned by Input#origin.
Fixed putting a parent-less node in nodes of a new node.
Fixed computing offset in positionBy().
Fixed rangeBy() when index is 0.
Fixed raws after rehydrating a JSON AST.
Fixed a regression affecting custom syntax.
Fixed a command regression in postcss-scss.
Fixed Processor#version so it works correctly for developers using the API.