postcss 8.5.30

Source: https://github.com/postcss/postcss
Tag scanned: 8.5.30
Compared with: 8.5.29 (0 signals introduced since)
Files: 104 scanned, 3 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 4.4 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:14

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import docs/writing-a-plugin.md:353:7

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    AtRule: {
      import: (atRule, { result }) => {
        const importedFile = parseImport(atRule)
        result.messages.push({
```
likely benign LLM, confidence 0.90 Documentation sample of a PostCSS plugin handling @import at-rules with a dynamic import.
Reasoning
Markdown documentation example of a PostCSS plugin at-rule visitor; the dynamic import is illustrative plugin code showing parseImport(atRule) resolving a path, not executable malicious code.
info ~~warn~~ → info by review encoding-base64 test/fromJSON.test.ts:39:51

base64-like blob (256 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbInguY3NzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFzQyxRQUFRLEVBQUUsdUJBQXVCIiwiZmlsZSI6InRvLmNzcyIsInNvdXJjZXNDb250ZW50IjpbIi5mb28geyBjb2xvcjogcmVkOyBmb250LXNpemU6IDEycHQ7IH0gLyogYWJjICovIEBtZWRpYSAod2lkdGg6IDYwZW0pIHsgfSJdfQ== */`
  )
})
```
dismissed LLM, confidence 0.95 Inline base64 source map fixture in a CSS test.
Reasoning
A base64 inline source map (sourceMappingURL data URI) embedded in a test fixture for PostCSS-style source map handling; decodes to ordinary CSS and JSON map content. Expected test data.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:132:79

base64-like blob (168 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
    noWorkResult.css,
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEiLCJmaWxlIjoiZm9vLmNzcyIsInNvdXJjZXNDb250ZW50IjpbIi5mb28geyBjb2xvcjogcmVkIH1cbiJdfQ== */'
  )
```
dismissed LLM, confidence 0.95 Base64-encoded inline source map in a test string.
Reasoning
Standard inline source map data URI used as test input for CSS processing; decodes to a benign version-3 source map.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:143:79

base64-like blob (180 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
    lazyResult.css,
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxXQUFXIiwiZmlsZSI6ImZvby5jc3MiLCJzb3VyY2VzQ29udGVudCI6WyIuZm9vIHsgY29sb3I6IHJlZCB9XG4iXX0= */'
  )
})
```
dismissed LLM, confidence 0.95 Base64-encoded inline source map in a test string.
Reasoning
Same benign inline source map fixture pattern as other tests in the file; no execution or hidden payload.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:149:79

base64-like blob (180 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
  let source =
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxXQUFXIiwiZmlsZSI6ImZvby5jc3MiLCJzb3VyY2VzQ29udGVudCI6WyIuZm9vIHsgY29sb3I6IHJlZCB9XG4iXX0= */\n'
```
dismissed LLM, confidence 0.95 Base64-encoded inline source map in a test string.
Reasoning
Repeated inline source map test fixture; benign test data.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:167:79

base64-like blob (180 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
  let source =
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxXQUFXIiwiZmlsZSI6ImZvby5jc3MiLCJzb3VyY2VzQ29udGVudCI6WyIuZm9vIHsgY29sb3I6IHJlZCB9XG4iXX0= */\n'
```
dismissed LLM, confidence 0.95 Base64-encoded inline source map in a test string.
Reasoning
Repeated inline source map test fixture; benign test data.
info ~~warn~~ → info by review dynamic-import test/old-node.js:19:1

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
require(
  path.join(
    process.cwd(),
```
likely benign LLM, confidence 0.70 Test script calling require with a path built from process.cwd().
Reasoning
require with path.join(process.cwd(), ...) is a dynamic require typical of a test fixture loading a local module for old Node compatibility checks; the path is built from cwd, not attacker-supplied input, though the snippet is truncated and the target is unseen.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/postcss/postcss postcss && cd postcss
git checkout 8.5.30
disclude scan --severity info --diff 8.5.29 .