build(deps-dev): bump css-loader from 7.1.4 to 7.1.5

[dependabot]

Bumps css-loader from 7.1.4 to 7.1.5.

Release notes

Sourced from css-loader's releases.

v7.1.5

7.1.5 (2026-08-28)

Bug Fixes

• strip BOM before processing with postcss (#1684) (bd20834)

Changelog

Sourced from css-loader's changelog.

7.1.5 (2026-08-28)

Bug Fixes

• strip BOM before processing with postcss (#1684) (bd20834)

Commits

• be04ec2 chore(release): 7.1.5
• 405bdde docs: deprecate css-loader in favor of webpack's built-in CSS support (#1683)
• bd20834 fix: strip BOM before processing with postcss (#1684)
• 488cdb1 chore(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#1663)
• fd4cb47 chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 (#1659)
• 4bf84fa docs: clarify style-loader usage in Getting Started (#1656)
• d7441e5 chore(deps): bump immutable from 5.1.3 to 5.1.5 (#1654)
• ca53a77 chore(deps): bump minimatch (#1653)
• See full diff in compare view

[claude]

🔍 Dependency Analysis Summary

Direct change (1):

Package	Old → New	Type	Bump
css-loader	7.1.4 → 7.1.5	devDependency	patch

Transitive lockfile drift (Dependabot regenerated the lockfile; not requested by this bump):

Package	Old → New	Pulled in by
postcss	8.5.25 → 8.5.26	css-loader's postcss-modules-* chain
postcss-selector-parser	7.1.4 → 7.1.5	css-loader
@codemirror/view	6.43.8 → 6.43.9	@codemirror/theme-one-dark (floating range)
@oxc-project/types	0.143.0 → 0.147.0	rolldown ← vite
rolldown + 14 platform bindings	1.2.3 → 1.2.6	vite 8.2.0
picomatch	4.0.5 → 4.0.7 (added alongside)	vite

Overall risk: LOW. Single patch bump of a build-time-only loader, one bug fix, no API surface change.

---

📋 Detailed Changelog Review

css-loader (7.1.4 → 7.1.5)

• Changes: One bug fix — bd20834 fix: strip BOM before processing with postcss (#1684). The rest of the commits in the range are docs and the loader's own devDependency bumps (lodash, flatted, immutable, minimatch), none of which ship in the published package's runtime deps.
• Breaking changes: None. engines unchanged at >= 18.12.0; peer ranges unchanged (@rspack/core 0.x || ^1.0.0 || ^2.0.0-0, webpack ^5.27.0), both optional.
• Security fixes: None in this release. The lodash/flatted/minimatch bumps are internal to the loader's repo and do not affect the installed tree.
• Migration notes: None.

Transitive: postcss 8.5.26, postcss-selector-parser 7.1.5

Patch-level. postcss 8.5.26 is already present in the tree on main (vite pulls it), so this only aligns css-loader's branch onto a version already installed — it does not add a new duplicate.

Transitive: rolldown 1.2.3 → 1.2.6, @oxc-project/types 0.147.0

Reached only through vite, which OCS does not use for its own build (webpack.config.js is the build; vite is a transitive dev dep). @rolldown/binding-android-arm-eabi is newly added as an optionalDependency — an extra platform binding that will not install on linux/darwin CI or dev machines.

Transitive: @codemirror/view 6.43.8 → 6.43.9

Patch. Reached through @codemirror/theme-one-dark's floating >=6.0.0 peer, used by @uiw/react-codemirror in the editors bundle.

---

⚠️ Impact Assessment

Breaking changes found: No.

Does the BOM fix change OCS output? No — I checked every CSS/SCSS file under assets/, components/, and static/css/ for a UTF-8 BOM prefix and found none. The fix is a no-op here, but it is a correctness improvement that guards against a contributor committing a BOM-prefixed stylesheet from a Windows editor later.

Affected files: webpack.config.js:44-51 is the only consumer:

{ test: /\.css$/i, use: [MiniCssExtractPlugin.loader, "css-loader", "postcss-loader"] }

It uses css-loader with zero options — no modules, no importLoaders, no url/import config. That is the smallest possible exposure to loader behaviour changes. No source file needs updating.

Build verification (actually run, not inferred): pnpm run dev with 7.1.5 installed compiles successfully — webpack 5.109.2, 5985 ms, no warnings or errors. All four CSS bundles emit at expected sizes:

Bundle	Size
css/site-tailwind.css	414 KiB
css/site-base.css	37.9 KiB
css/pipeline.css	11.3 KiB
css/editors.css	1.38 KiB

The build log confirms css-loader@7.1.5_webpack@5.109.2 is the resolved loader for site-base.css, site-tailwind.css, editors.css, pipeline/styles.css, and reactflow's vendored CSS. The secondary ESM config (chat-widget-context.js) also compiles clean.

Test impact: None. css-loader is build-time only and is not referenced by any pytest or JS test.

Configuration changes: None required.

---

🛠️ Recommendations

Action required: None. Merge as-is.

Testing focus: Already covered — the webpack build is the entire blast radius and it is green with the new version. The postcss/rolldown/codemirror drift is either versions already in the tree or on code paths OCS does not build through.

Follow-up tasks (separate PRs, not blockers here):

1. css-loader is now formally deprecated upstream. Commit 405bdde — "docs: deprecate css-loader in favor of webpack's built-in CSS support" — landed in this exact version range. Webpack 5's experimental CSS support (experiments.css) is the intended successor, replacing MiniCssExtractPlugin.loader + css-loader in the chain. OCS is on webpack 5.109.2 so this is viable to evaluate, but it changes how Tailwind's PostCSS step is wired — it wants its own PR with a diff of the emitted CSS, not a drive-by.

2. Pre-existing @codemirror/view duplication. The lockfile carries both 6.43.7 (the direct dep pin in package.json, and what @uiw/react-codemirror resolves against) and 6.43.9 (via @codemirror/theme-one-dark's floating range). CodeMirror warns that multiple @codemirror/view/state instances in one tree can misbehave at runtime. This predates the PR — main has the same split at 6.43.7 + 6.43.8 — so it is not introduced here, but a pnpm.overrides entry pinning @codemirror/view would collapse it. Worth a look if the editors UI ever behaves oddly.

Merge recommendation: ✅ APPROVE

Patch bump, dev-only dependency, one upstream bug fix with no API change, zero-option usage in the single config that consumes it, and the full asset build verified green locally.

---

📚 Useful Links

• css-loader v7.1.5 release notes
• css-loader CHANGELOG
• Full diff v7.1.4...v7.1.5
• PR #1684 — strip BOM before processing with postcss
• PR #1683 — deprecation notice in favor of webpack built-in CSS
• webpack experiments.css docs

[claude]

🔍 Dependency Analysis Summary

Package	Old	New	Type	Scope
css-loader	7.1.4	7.1.5	PATCH	devDependencies (direct)
postcss-selector-parser	7.1.4	7.1.5	PATCH	transitive (via postcss-modules-local-by-default / postcss-modules-scope)

Overall risk: LOW — build-time-only patch bump. Two bug-fix releases, no API surface changes, no runtime dependency, no lockfile churn beyond the two packages above.

---

📋 Detailed Changelog Review

css-loader (7.1.4 → 7.1.5)

• Changes: Single bug fix — strip BOM before processing with postcss (#1684). A UTF-8 byte order mark at the start of a .css file previously reached postcss and could break parsing of the first rule.
• Breaking Changes: None.
• Security Fixes: None.
• Migration Notes: None. engines constraint unchanged (node >= 18.12.0); peer dep ranges on webpack/@rspack/core unchanged.

postcss-selector-parser (7.1.4 → 7.1.5) — transitive

Three parser-robustness fixes:

• Don't treat a non-prefix token before | as a namespace (#324)
• Preserve whitespace before a * namespace in attribute selectors (#325)
• Fix TypeError on unclosed [, ( and trailing | (#330)

All three are edge cases in selector parsing. Note this package is only pulled in through the CSS Modules plugins (postcss-modules-local-by-default, postcss-modules-scope) — and OCS has no *.module.css files, so those code paths are effectively dormant here.

---

⚠️ Impact Assessment

• Breaking Changes Found: No.
• Affected Files: Only webpack.config.js:48, where css-loader sits in the .css rule chain between MiniCssExtractPlugin.loader and postcss-loader. No loader options are passed, so no option-shape change could apply.
• Test Impact: None. css-loader is not referenced from any test, and the Stencil-based components/chat_widget has its own toolchain that doesn't use it.
• Configuration Changes: None required.
• BOM fix relevance: I scanned every .css file under assets/ and components/ — none currently begin with a UTF-8 BOM, so this fix is a latent safety net rather than something that changes current output.

Verification performed

Ran pnpm run build against the updated lockfile:

• ✅ Both webpack configs compiled successfully (legacy bundle + ES modules bundle)
• ✅ Build log confirms css-loader@7.1.5 in the loader chain for site-base.css, site-tailwind.css, assets/javascript/apps/pipeline/styles.css, and reactflow's CSS
• ✅ Working tree clean afterwards — no committed artifacts drifted
• ⚠️ Two warnings emitted (asset size limit / entrypoint size limit for tokenCounter, pipeline, site-tailwind, etc.) — these are pre-existing and unrelated to this bump

---

🛠️ Recommendations

• Action Required: None.

• Testing Focus: Nothing specific. A visual smoke check of a Tailwind-heavy page after deploy is sufficient if you want belt-and-braces, but the compiled CSS should be unchanged given no BOMs exist in the source.

• Follow-up Tasks (informational, out of scope for this PR):

  The same release train carried a deprecation notice for the package:

  css-loader is deprecated — webpack parses CSS itself and no longer needs it.

  This matters because OCS is already on webpack 5.109.2, and native CSS support (experiments.css, defaulting to "auto") landed in 5.109.0. Upstream explicitly supports incremental migration — built-in CSS stays off for any .css rule that already has a loader, so rules can move one at a time. Worth a separate ticket to evaluate dropping css-loader + mini-css-extract-plugin in favour of native CSS, but it is not a blocker here and should not be bundled into a Dependabot PR.

• Merge Recommendation: ✅ APPROVE — low-risk patch bump, build verified green.

---

📚 Useful Links

• css-loader v7.1.5 release notes
• css-loader CHANGELOG
• css-loader#1684 — strip BOM before processing with postcss
• postcss-selector-parser CHANGELOG
• webpack Native CSS guide (for the deprecation follow-up)
• Full diff v7.1.4...v7.1.5