postcss 8.5.31

Source: https://github.com/postcss/postcss
Tag scanned: 8.5.31
Compared with: 8.5.30 (0 signals introduced since)
Files: 104 scanned, 3 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 7 info
Scan time: 4.9 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 7 of 7 warn and critical signals; 7 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 11:45

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import docs/writing-a-plugin.md:353:7

[embedded javascript] dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
```
    AtRule: {
      import: (atRule, { result }) => {
        const importedFile = parseImport(atRule)
        result.messages.push({
```
likely benign LLM, confidence 0.90 Documentation example of a PostCSS plugin visitor that handles @import at-rules.
Reasoning
Snippet is a PostCSS plugin example inside a markdown doc showing an at-rule visitor; the dynamic import is in illustrative documentation code, not executable payload. Markdown context makes it benign.
info ~~warn~~ → info by review encoding-base64 test/fromJSON.test.ts:39:51

base64-like blob (256 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbInguY3NzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFzQyxRQUFRLEVBQUUsdUJBQXVCIiwiZmlsZSI6InRvLmNzcyIsInNvdXJjZXNDb250ZW50IjpbIi5mb28geyBjb2xvcjogcmVkOyBmb250LXNpemU6IDEycHQ7IH0gLyogYWJjICovIEBtZWRpYSAod2lkdGg6IDYwZW0pIHsgfSJdfQ== */`
  )
})
```
likely benign LLM, confidence 0.93 Inline base64 source map used as a test fixture for CSS parsing.
Reasoning
The base64 blob is a standard inline CSS source map (sourceMappingURL data URI) embedded in a test fixture; it decodes to ordinary JSON map data and is expected in a PostCSS-style test suite.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:132:79

base64-like blob (168 bytes, compression ratio 0.93) (raw pass, confidence 0.60)
```
    noWorkResult.css,
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEiLCJmaWxlIjoiZm9vLmNzcyIsInNvdXJjZXNDb250ZW50IjpbIi5mb28geyBjb2xvcjogcmVkIH1cbiJdfQ== */'
  )
```
likely benign LLM, confidence 0.93 Inline base64 source map in a test fixture string.
Reasoning
Standard inline sourcemap data URI in a test string literal, decoding to a small JSON map for foo.css; typical of CSS tooling tests.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:143:79

base64-like blob (180 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
    lazyResult.css,
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxXQUFXIiwiZmlsZSI6ImZvby5jc3MiLCJzb3VyY2VzQ29udGVudCI6WyIuZm9vIHsgY29sb3I6IHJlZCB9XG4iXX0= */'
  )
})
```
likely benign LLM, confidence 0.93 Inline base64 source map in a test fixture string.
Reasoning
Same pattern: a base64 inline source map in a test string literal with benign CSS content.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:149:79

base64-like blob (180 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
  let source =
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxXQUFXIiwiZmlsZSI6ImZvby5jc3MiLCJzb3VyY2VzQ29udGVudCI6WyIuZm9vIHsgY29sb3I6IHJlZCB9XG4iXX0= */\n'
```
likely benign LLM, confidence 0.93 Inline base64 source map in a test fixture string.
Reasoning
Repeated inline source map fixture in a test; decodes to benign mapping JSON.
info ~~warn~~ → info by review encoding-base64 test/no-work-result.test.ts:167:79

base64-like blob (180 bytes, compression ratio 0.86) (raw pass, confidence 0.60)
```
  let source =
    '.foo { color: red }\n\n/*# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbImZvby5jc3MiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxXQUFXIiwiZmlsZSI6ImZvby5jc3MiLCJzb3VyY2VzQ29udGVudCI6WyIuZm9vIHsgY29sb3I6IHJlZCB9XG4iXX0= */\n'
```
likely benign LLM, confidence 0.93 Inline base64 source map in a test fixture string.
Reasoning
Repeated inline source map fixture in a test; decodes to benign mapping JSON.
info ~~warn~~ → info by review dynamic-import test/old-node.js:19:1

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
require(
  path.join(
    process.cwd(),
```
likely benign LLM, confidence 0.80 Test helper requiring a module via a path built from process.cwd().
Reasoning
A require call with path.join(process.cwd(), ...) in a test file for old Node versions is a dynamic path load of a local module, common in test harnesses. Remaining doubt because the rest of the specifier is not shown.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/postcss/postcss postcss && cd postcss
git checkout 8.5.31
disclude scan --severity info --diff 8.5.30 .