postcss 8.5.31

Source: https://github.com/postcss/postcss
Tag scanned: 8.5.31
Compared with: 8.5.30 (0 signals introduced since)
Files: 104 scanned, 3 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 5.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-19 08:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import docs/writing-a-plugin.md:353:7

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    AtRule: {
      import: (atRule, { result }) => {
        const importedFile = parseImport(atRule)
        result.messages.push({
```
likely benign LLM, confidence 0.90 Markdown doc snippet of a PostCSS plugin handling @import at-rules.
Reasoning
Documentation example code inside a markdown file showing a PostCSS plugin visitor for at-rule imports; a dynamic import with a variable specifier is a normal pattern in plugin docs and not executed code.
info ~~warn~~ → info by review encoding-base64 test/fromJSON.test.ts:39:51

base64-like blob (256 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbInguY3NzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFzQyxRQUFRLEVBQUUsdUJBQXVCIiwiZmlsZSI6InRvLmNzcyIsInNvdXJjZXNDb250ZW50IjpbIi5mb28geyBjb2xvcjogcmVkOyBmb250LXNpemU6IDEycHQ7IH0gLyogYWJjICovIEBtZWRpYSAod2lkdGg6IDYwZW0pIHsgfSJdfQ== */`
  )
})
```
likely benign LLM, confidence 0.93 Inline base64 CSS source map in a test fixture string.
Reasoning
A standard inline source map comment with a base64 JSON payload containing readable sourcemap data (sources, mappings, sourcesContent of CSS). Typical in PostCSS test suites; no execution or hidden payload.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:132:79

base64-like blob (168 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
    noWorkResult.css,
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEiLCJmaWxlIjoiZm9vLmNzcyIsInNvdXJjZXNDb250ZW50IjpbIi5mb28geyBjb2xvcjogcmVkIH1cbiJdfQ== */'
  )
```
likely benign LLM, confidence 0.93 Inline base64 source map in a PostCSS test fixture.
Reasoning
Inline sourceMappingURL base64 source map for a tiny CSS test fixture; decodes to benign JSON describing '.foo { color: red }'.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:143:79

base64-like blob (180 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
    lazyResult.css,
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxXQUFXIiwiZmlsZSI6ImZvby5jc3MiLCJzb3VyY2VzQ29udGVudCI6WyIuZm9vIHsgY29sb3I6IHJlZCB9XG4iXX0= */'
  )
})
```
likely benign LLM, confidence 0.93 Inline base64 source map in a test fixture string.
Reasoning
Same benign inline source map pattern used for test fixture CSS; the payload is ordinary sourcemap JSON.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:149:79

base64-like blob (180 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
  let source =
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxXQUFXIiwiZmlsZSI6ImZvby5jc3MiLCJzb3VyY2VzQ29udGVudCI6WyIuZm9vIHsgY29sb3I6IHJlZCB9XG4iXX0= */\n'
```
likely benign LLM, confidence 0.93 Inline base64 source map in a test fixture string.
Reasoning
Repeated benign inline source map fixture in a test file; no decoding into executable content.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:167:79

base64-like blob (180 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
  let source =
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxXQUFXIiwiZmlsZSI6ImZvby5jc3MiLCJzb3VyY2VzQ29udGVudCI6WyIuZm9vIHsgY29sb3I6IHJlZCB9XG4iXX0= */\n'
```
likely benign LLM, confidence 0.93 Inline base64 source map in a test fixture string.
Reasoning
Repeated benign inline source map fixture in a test file; the blob is standard sourcemap metadata.
info ~~warn~~ → info by review dynamic-import test/old-node.js:19:1

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
require(
  path.join(
    process.cwd(),
```
likely benign LLM, confidence 0.80 Test script requiring a module via a computed path built from process.cwd().
Reasoning
A require with a path.join of process.cwd() and likely a literal filename in a test for old Node compatibility. The specifier is computed but resolves to local paths, a common test-harness pattern; the snippet is truncated so the remainder is not visible, which leaves some doubt.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/postcss/postcss postcss && cd postcss
git checkout 8.5.31
disclude scan --severity info --diff 8.5.30 .