# What changed in postcss

> 42 changes in postcss 8 from its official release notes, upgrade guides and advisories: 2 breaking, 3 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/postcss/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## postcss 8

### Breaking changes

- Source maps are no longer loaded unless opts.from is provided, preventing potentially unsafe source-map loading. (8.5.23) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.23), [security advisory](https://github.com/advisories/GHSA-FXQJ-RQCC-2CMP)
- Previous source maps are restricted to the opts.from folder for security reasons. (8.5.18) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.18), [security advisory](https://github.com/advisories/GHSA-R28C-9Q8G-F849)

### Security

- Fixed prototype hijacking when using postcss.fromJSON(). (8.5.17) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.17)
- PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments (8.5.12) — [security advisory](https://github.com/advisories/GHSA-6G55-P6WH-862Q), [release notes](https://github.com/postcss/postcss/releases/tag/8.5.12)
- PostCSS has XSS via Unescaped </style> in its CSS Stringify Output (8.5.10) — [security advisory](https://github.com/advisories/GHSA-QX2V-QP2M-JG93), [release notes](https://github.com/postcss/postcss/releases/tag/8.5.10)

### New APIs and options

- Set unsafeMap to true to disable the previous source maps folder restriction. (8.5.18) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.18)
- Added opts.unsafeMap to disable checks. (8.5.12) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.12)

### Performance

- Declaration parsing performance was fixed, improving how PostCSS processes declarations. (8.5.15) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.15)
- Improved performance when parsing nested brackets. (8.5.11) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.11)
- Speeds up source map encoding parsing when an error occurs. (8.5.9) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.9)
- Improved performance when cleaning source map annotations. (8.5.7) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.7)

### Fixes and other changes

- Fixes broken source maps caused by escaping </style> in CSS. (8.5.30) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.30)
- Comments are now supported when using list.comma() and list.space(). (8.5.29) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.29)
- Improved escaping of closing style tags. (8.5.29) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.29)
- Fixes a types regression. (8.5.28) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.28)
- Fixed removing comments starting with /*#. (8.5.27) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.27)
- Fixed handling of the * hack before a comment in Custom Properties. (8.5.27) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.27)
- Fixed Chinese text displayed in a deprecation warning. (8.5.27) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.27)
- Fixed empty values appearing in the middle of comma-separated lists. (8.5.27) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.27)
- Fixed handling of whitespace-only values in space-separated lists. (8.5.27) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.27)
- Fixed a rule's end position when a space appears before a semicolon. (8.5.27) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.27)
- Fixed type definitions. (8.5.27) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.27)
- Fixed a regression in list.split(). (8.5.26) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.26)
- Source map loading now tracks symlinks in path protection. (8.5.26) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.26)
- Fixed list.split for non-string values. (8.5.25) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.25)
- Fixed a regression affecting visitors introduced in 8.5.17. (8.5.25) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.25)
- Preserves the BOM after processing. (8.5.24) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.24)
- Fixed custom properties losing their semicolon before a comment. (8.5.22) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.22)
- Fixed childless at-rules losing their semicolon before a comment during processing. (8.5.21) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.21)
- Fixed a missing space when AtRule#params is set after. (8.5.20) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.20)
- Fixed a mixing AST error that occurred on warnings. (8.5.20) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.20)
- Fixed cleaning before for new nodes inserted to Root. (8.5.19) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.19)
- Fixed Input#origin() behavior for unmapped end positions. (8.5.17) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.17)
- Fixed an error that could exceed the maximum call stack size. (8.5.17) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.17)
- Fixed the position returned by Input#origin. (8.5.16) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.16)
- Fixed putting a parent-less node in nodes of a new node. (8.5.16) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.16)
- Fixed computing offset in positionBy(). (8.5.16) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.16)
- Fixed rangeBy() when index is 0. (8.5.16) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.16)
- Fixed raws after rehydrating a JSON AST. (8.5.16) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.16)
- Fixed a regression affecting custom syntax. (8.5.14) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.14)
- Fixed a command regression in postcss-scss. (8.5.13) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.13)
- Fixed Processor#version so it works correctly for developers using the API. (8.5.8) — [release notes](https://github.com/postcss/postcss/releases/tag/8.5.8)