PostCSS 8.5.23

PostCSS 8.5.23 has been released — the popular CSS post-processor ships a security-focused update addressing source map handling.

Security Fix: Source Map Loading

PostCSS 8.5.23 introduces a security hardening measure around source map loading. The project now refuses to load source maps when the opts.from option is not explicitly set. This prevents potential information disclosure scenarios where a malicious CSS file could trick PostCSS into loading source maps from unexpected locations.

While this change may require updating existing configurations that relied on implicit source map resolution, the fix follows security best practices by defaulting to the safer path.

What This Means for You

• If you use PostCSS programmatically, ensure you always pass from in your options object
• If you use PostCSS via a build tool (Vite, Webpack, etc.), your tool likely already sets from automatically — no action needed
• If you see new warnings about missing source maps, check your PostCSS configuration for the from option

Upgrade

PostCSS 8.5.23 is available on npm. Update with npm install postcss@latest or let your package manager handle the resolution. See the release notes for details.