[dependabot]

Bumps the npm-dependencies group with 2 updates: magic-string and postcss.

Updates magic-string from 1.4.4 to 1.4.5

Release notes

Sourced from magic-string's releases.

v1.4.5

   🐞 Bug Fixes

• Reject non-integer and out-of-range indices consistently  -  by @​antfubot in Rich-Harris/magic-string#373 (02dfc)
• Keep the stored name when an overwritten range was split  -  by @​antfubot in Rich-Harris/magic-string#374 (729cb)
• Shift replacesUntil and replacedFrom in Bundle#toMagicString  -  by @​youdie006 in Rich-Harris/magic-string#369 (ab6e9)
• Respect indent exclusions on moved edits and CRLF bundle intros  -  by @​antfubot in Rich-Harris/magic-string#377 (280bc)
• bundle: Stop addSource mutating the caller's source description  -  by @​antfubot in Rich-Harris/magic-string#375 (c14d3)

   🏎 Performance

• Cut allocations and quadratic lookups on the sourcemap and bundle paths  -  by @​antfubot in Rich-Harris/magic-string#379 (d0812)
• Find the slice start chunk without scanning the list  -  by @​antfubot in Rich-Harris/magic-string#378 (6ab6b)

    View changes on GitHub

Changelog

Sourced from magic-string's changelog.

1.4.5 (2026-10-27)

Bug Fixes

• bundle: stop addSource mutating the caller's source description (#375) (c14d303)
• keep the stored name when an overwritten range was split (#374) (729cbb2)
• reject non-integer and out-of-range indices consistently (#373) (02dfc82)
• respect indent exclusions on moved edits and CRLF bundle intros (#377) (280bc3e)
• shift replacesUntil and replacedFrom in Bundle#toMagicString (#369) (ab6e912), closes Bundle#toMagicString

Performance Improvements

• cut allocations and quadratic lookups on the sourcemap and bundle paths (#379) (d081246)
• find the slice start chunk without scanning the list (#378) (6ab6b04)

Commits

• 5dcd2bc chore: release v1.4.5
• b77c7ea refactor: share the mappings walk and sync the docs with the code (#382)
• 6ab6b04 perf: find the slice start chunk without scanning the list (#378)
• d081246 perf: cut allocations and quadratic lookups on the sourcemap and bundle paths...
• 0c6698f test: check random edit sequences against a reference edit model (#381)
• 60382a8 chore: port the benchmark to vitest bench and cover the sourcemap hot paths (...
• 280bc3e fix: respect indent exclusions on moved edits and CRLF bundle intros (#377)
• c14d303 fix(bundle): stop addSource mutating the caller's source description (#375)
• 98b6f12 test: drop the duplicated out-of-bounds move test (#376)
• f1576fa chore: remove the unused DEBUG timing instrumentation (#372)
• Additional commits viewable in compare view

Updates postcss from 8.5.31 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

Changelog

Sourced from postcss's changelog.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

Commits

• 2455ac8 Release 8.5.32 version
• e367106 Update dependencies
• f70f586 Fix Input#origin() without from or with relative sourceRoot (#2179)
• eb28619 Fix final-word lookup without source offsets (#2178)
• 095654b Preserve explicit start in Warning#toString() (#2177)
• 9b3d8b8 Preserve Promise semantics in result finally() (#2176)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​postcss@​8.5.31 ⏵ 8.5.32	+1		+1
	npm/​magic-string@​1.4.4 ⏵ 1.4.5	+1		+1

View full report

[deepsource-io]

DeepSource Code Review

We reviewed changes in 02106f8...873ddfd on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Nov 3, 2026 10:24a.m.	Review ↗
Secrets		Nov 3, 2026 10:24a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.