Bump lightningcss from 1.29.1 to 1.33.0 in /js

[dependabot]

Bumps lightningcss from 1.29.1 to 1.33.0.

Release notes

Sourced from lightningcss's releases.

v1.33.0

Added

• Add support for ::highlight by @​lucasweng in parcel-bundler/lightningcss#970
• Add support for @​position-try at-rule by @​mattcosta7 in parcel-bundler/lightningcss#1238 #851
• Add support for ::search-text and :current::search-text (#1212) by @​lucinadin in parcel-bundler/lightningcss#1213
• Collapse light-dark(x, x) to x by @​cscnk52 in parcel-bundler/lightningcss#1183
• Supports :target-before/after/current pseudo-class by @​yisibl in parcel-bundler/lightningcss#1185
• Support for the alpha() relative color function by @​yisibl in parcel-bundler/lightningcss#1266

Fixed

• Print unknown at-rules in the same location by @​RobinMalfait in parcel-bundler/lightningcss#1233
• Fix #rrggbbaa support on older versions of android by @​fkeiler in parcel-bundler/lightningcss#1198
• Replace atty with std::io::IsTerminal by @​fkeiler in parcel-bundler/lightningcss#1197
• Bump dependencies (cssparser, const-str) by @​noahbald in parcel-bundler/lightningcss#1200
• Fix minification of negative scientific notation dimensions by @​ssssota in parcel-bundler/lightningcss#1192
• Change serde attribute to be conditional for ResolveResult enum File variant by @​FlorianDevP in parcel-bundler/lightningcss#1251
• Add external to return type of resolve by @​sapphi-red in parcel-bundler/lightningcss#1261

v1.32.0

Added

• Enable custom resolvers to mark imports as external. Resolvers may now return {external: string} to mark an import as external. This will leave the @import in the output CSS instead of bundling it. See the docs for details.
• Allow visitors to add dependencies. Visitors may now be functions which receive an addDependency function as an option. Dependencies may be used by tools that call Lightning CSS such as bundlers to implement file watching or caching. See the docs for details.
• Add mix-blend-mode property support

Fixed

• Output unknown color-scheme keywords as-is instead of normal
• Improved serialization of the rotate property
• keep a single space between functions when formatting transform values
• Fix additionally inserted whitespace in var(--foo,) and env(--foo,)
• Convert the percentage in the scale property or scale() to a number
• update compat data

v1.31.0

Features

• Implement scroll-state container queries
• Allow @​property to be nested inside at-rules
• Support print-color-adjust property
• Support <string> in @​property syntax
• Add :state() pseudo-class support
• Reduce min(), max() and clamp() with number arguments
• Support name-only @​container queries

Fixes

• Ensure compiled range media queries are correctly parenthesised
• Add quotes to font-families with multiple consecutive spaces

... (truncated)

Commits

• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: area/dependencies, team/ui. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The pull request successfully updates lightningcss to version 1.33.0 across the account-ui and admin-ui applications. Although the project is technically 'up to standards' per Codacy, critical security vulnerabilities were detected in the pnpm-lock.yaml file (CVE-2026-6951 and CVE-2026-40181). These vulnerabilities represent significant security risks and should be addressed before merging to prevent potential remote code execution and phishing attacks.

About this PR

• The project contains systemic security debt within its dependencies. Specifically, vulnerabilities in simple-git and react-router expose the build environment and the UI applications to high-risk exploits. It is recommended to perform a wider audit of the lockfile.

2 comments outside of the diff

js/pnpm-lock.yaml

_{line 310 🔴 HIGH RISK}
The simple-git package is vulnerable to Remote Code Execution (CVE-2026-6951). This is a high-risk security flaw that could allow an attacker to execute arbitrary commands. Updating to version 3.36.0 is required.

Try running the following prompt in your IDE agent:

Update simple-git to version 3.36.0 in js/pnpm-lock.yaml to resolve CVE-2026-6951.

_{line 116 🟡 MEDIUM RISK}
The react-router package contains an open redirect vulnerability (CVE-2026-40181). This can be exploited to redirect users to malicious domains. Upgrading to 6.30.4 is strongly advised.

Try running the following prompt in your IDE agent:

Update react-router to version 6.30.4 in the JS workspace to fix the open redirect vulnerability (CVE-2026-40181).

Test suggestions

• Ensure account-ui project build and CSS minification processes complete successfully with the updated compiler version.
• Ensure admin-ui project build and CSS minification processes complete successfully with the updated compiler version.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Ensure account-ui project build and CSS minification processes complete successfully with the updated compiler version.
2. Ensure admin-ui project build and CSS minification processes complete successfully with the updated compiler version.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}