Bump the npm_and_yarn group across 1 directory with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: next and postcss.

Updates next from 15.5.18 to 15.5.21

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

15.5.19

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [15.5.x] Don't drop FormData entries (#94244)

Other

• [15.5.x] Fix CI (#94281)

Credits

Huge thanks to @​eps1lon for helping!

Commits

• e26f6ff v15.5.21
• 7f5deeb [15.x] Improve performance of checking valid MPA form submissions
• 57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• e3e5666 [15.x] Set correct origin for internal redirects in custom server
• 35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
• 062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• 577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• 530d4fa [15.x] fix(next/image): improve performance of detectContentType()
• 8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
• ff12a61 [15.x] Validate server reference IDs during manifest lookup
• Additional commits viewable in compare view

Updates postcss from 8.5.10 to 8.5.18

Release notes

Sourced from postcss's releases.

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

Changelog

Sourced from postcss's changelog.

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

Commits

• 4c0d194 Release 8.5.18 version
• 92b4e78 Update dependencies
• 95663d3 Limit where source map can be loaded for security reasons
• 74e25ae Release 8.5.17 version
• d1518af Fix Maximum call stack size exceeded error
• 2421312 Fix linter
• a50352c Fix CI
• 33948f0 Prevent prototype hijacking in fromJSON
• 2131909 Update dependencies
• 93440ab Fix non-closed \<div align="center"> in README (#2110)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gitbutler-docs	Error		Jul 30, 2026 8:27pm