chore(deps-dev): bump cssnano from 8.0.7 to 9.1.2

[dependabot]

Bumps cssnano from 8.0.7 to 9.1.2.

Release notes

Sourced from cssnano's releases.

v9.1.2

What's Changed

• fix: collapse redundant whitespace in at-rules in cssnano/cssnano#1999

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.1.1...cssnano@9.1.2

v9.1.1

What's Changed

Bug Fixes

• fix(postcss-convert-values): preserve unicode range in cssnano/cssnano#1995

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.1.0...cssnano@9.1.1

v9.1.0

What's Changed

New Features

• Merge corner border-*-radius longhands into border-radius shorthands. Four complete corner declarations in the same importance lane now collapse into one shorthand, with horizontal and vertical axes minified independently and separated by a slash when distinct.

Bug fixes and Improvements

• Merge margin, padding, border, border-radius, columns, and border-spacing declarations inside at-rule containers such as @page, @position-try, and nested at-rules. Fold identical horizontal and vertical border-spacing components to a single value. Recognize columns shorthands combining a count and a math function in either order, and preserve invalid declarations as written: border shorthands with multiple styles and columns values combining CSS-wide keywords with widths or counts no longer discard preceding valid longhands.

• Preserve percentage units in registered custom-property initial values with composite syntax, ranges, groups, and multipliers, and avoid clamping numeric operands nested inside alpha-value functions.

• Restrict color minification to CSS properties that accept <color> and custom properties, preserving custom identifiers in properties like animation-name, grid-area, and counter-reset. Add support for hwb() color values and minification inside color-mix(), light-dark(), and var() fallbacks, while preserving relative color syntax, math functions, and token boundary separators.

• Preserve zero percentage units in rgb(), rgba(), and modern CSS Color 4 functions to avoid invalid syntax, respect disabled time conversions for 0ms, clamps percentage opacity values adhering to CSS Color 4 alpha semantics, and improve compatibility with uppercase at-rules and vendor-prefixed keyframes.

• Preserves zero length in columns shorthands and zero units inside @property with <angle-percentage> syntax, retaining keyframe percentage units under nested rules. Symmetrically rounds negative numbers when precision is configured, converts between metric units (mm, cm, q), preserves zero percentages on SVG stroke properties to retain transition interpolation, and caches Browserslist lookups across runs. Also preserves units inside CSS Fonts 5 override descriptors, anchor() functions, flex-basis, and IE-targeted sizing properties.

• Remove comments more reliably and preserve the ones you keep exactly. Comments are now removed from !important declaration values and comment detection respect CSS token boundaries: text inside unquoted url() values and behind escape sequences in strings and identifiers is no longer mistaken for a comment. Kept comments are emitted byte-for-byte, including an unclosed comment at the end of a value, and whitespace inside kept comments is left untouched. Removal state is scoped to each document, so a shared processor no longer carries removeAllButFirst first-comment state between runs, and the remove callback runs once per comment occurrence. A non-function remove option now fails with a TypeError.

• Improve conformance for modern CSS math functions, grid-line values, and case-sensitive attribute selector modifiers while preserving ambiguous or invalid declarations. The affected transforms now use bounded, linear scans for these forms.

• Value transforms now read the CSS Values 4 math function names from one mathFunctions table in cssnano-utils, so unit retention, box and shorthand merging, parameter and whitespace handling, and time classification agree on which functions count as math functions. Serialized output is unchanged.

• Standardize output normalization for margin, padding, and physical border properties. Property names and case-insensitive keywords in generated shorthands and normalized standalone shorthand declarations are canonicalized to lowercase, while preserving author casing for unmerged longhands, custom properties, hack prefixes, and unresolved values.

• perf: median 15% speed increase on test fixtures

• postcss-normalize-url now decodes quoted url(...) values, preserving literal backslashes and escape sequences whether quotes are stripped or kept. Relative URLs now normalize using POSIX path semantics across all platforms, and converted @namespace URLs escape double quotes.

• Join every escaped line continuation in a multiline url() value into one line, including \r\n continuations that previously left an invalid string behind. Rewriting a @namespace URL no longer overwrites the tokens that follow it, so trailing text is preserved and multiple URLs in one namespace declaration are each normalized.

• Remove insignificant whitespace around custom-property names and, in standard declarations, around env() custom-ident arguments and around comma delimiters in var(), env(), and constant(). Between a custom-property name and its value, only the parser-consumed leading whitespace run is dropped; authored whitespace elsewhere in the value, such as after a preserved comment, is preserved per CSS Variables 2. Required whitespace between distinct tokens and the single whitespace token in an empty fallback remain preserved, and a preserved comment kept between a declaration name and value now survives minification, for custom properties and standard declarations alike. Comment removal in selectors and values no longer fuses the tokens the comment in-between: an attribute case-insensitivity flag or any other name-like token keeps its boundary, and math-operator spacing is restored for every function whose value productions accept <calc-sum> arguments (including calc-size(), calc-mix(), and random()). Values without comments are now left byte-for-byte untouched rather than re-spaced.

• Preserve whitespace around division operators across all modern CSS math functions such as min(), max(), and clamp(), and trim extraneous whitespace from commas in nested calculations.

... (truncated)

Commits

• a1a14a8 Publish cssnano 9.1.2
• 3f66a8c chore: update pnpm to 12.8.1
• 2236cf9 fix(website): fix advanced preset loading
• 5f9202d test: add more test coverage for whitespace minimization
• b9b8f77 chore: fix source map
• 3091ffd fix: collapse redundant whitespace in at-rules
• 4e0777e fix: update browserslist
• 2d6b07e test: fix outdated mutation tests
• 49ce934 chore: update formatter and linter
• 5095cdc chore: use consistent file extensions for modules
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
shepherd-docs	Ready	Preview	Oct 5, 2026 10:06am UTC
shepherd-landing	Ready	Preview	Oct 5, 2026 10:06am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f05374dd-dc5b-453a-8e05-c4a61609752c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jcarver989]

Hi @RobbieTheWagner! I'm a fellow human (not a clanker). Your time as an open-source maintainer is super valuable. To help save you time when reviewing this PR, I ran an analysis tool that I work on (PatchWave). It combines static analysis + AI to determine if dependency upgrades are safe to merge. You can see the results below. Hope it helps!

This PR needs a code fix and human review

cssnano 9.1.2 raises its Node.js minimum beyond the monorepo's declared >=22.12 and requires PostCSS ^8.5.28, while the Shepherd package currently resolves 8.5.26. CI passed, but it doesn't cover the declared minimum Node.js version or the PostCSS peer mismatch.

⚠️ Needs code fix and human review (1)

Dependency	Update
cssnano	8.0.7 → 9.1.2

You can see the full report here