Installations
npm install @csstools/postcss-cascade-layersScore
95.9
Supply Chain
99.4
Quality
85.9
Maintenance
100
Vulnerability
100
License
Releases
Unable to fetch releases
Developer
Developer Guide
Module System
ESM
Min. Node Version
>=18
Typescript Support
Yes
Node Version
22.1.0
NPM Version
10.7.0
Statistics
912 Stars
4,090 Commits
72 Forks
11 Watching
3 Branches
131 Contributors
Updated on 28 Nov 2024
Bundle Size
63.01 kB
Minified
16.27 kB
Minified + Gzipped
Languages
CSS (43.44%)
JavaScript (30.18%)
TypeScript (22.78%)
HTML (3.02%)
Nunjucks (0.48%)
Shell (0.1%)
Total Downloads
Cumulative downloads
Total Downloads
399,228,865
Last day
-4.5%
675,180
Compared to previous day
Last week
1.5%
3,765,100
Compared to previous week
Last month
5.6%
15,920,671
Compared to previous month
Last year
10%
183,538,902
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Peer Dependencies
1
PostCSS Plugins 
We are happy you're here!
This repository contains plugins, plugin-packs, utilities, CLI tools, ... to help you do more with CSS.
PostCSS Preset Env
Read more about PostCSS Preset Env or jump right in :
- Install
postcss-preset-envfrom npm. - Add
postcss-preset-envto your configuration:
1const postcssPresetEnv = require('postcss-preset-env'); 2 3const yourConfig = { 4 plugins: [ 5 /* other plugins */ 6 /* remove autoprefixer if you had it here, it's part of postcss-preset-env */ 7 postcssPresetEnv({ 8 /* pluginOptions */ 9 features: {}, 10 }) 11 ] 12}
Overview
- packages
- css tokenizers and parsers
- common utilities
- PostCSS plugins
- PostCSS Preset Env
- Stylelint plugins
- cli's
- sites
- PostCSS recipes
Our current focus
Standard CSS transforms
We're trying to bring every reasonable CSS Spec into all the browsers.
First we keep track of new features through the CSSDB (see the repo). Then we do our best to create a PostCSS plugin that can convert that new syntax/function/rules so every browser can understand it.
While it's not always possible we're enabling over 50 features with these plugins!
Developer experience
We want it to be easier for you to be effective at writing CSS.
From time to time we will publish plugins that aren't related to a standard CSS spec but that we think will help developers.
Contributing
Thanks for being willing to contribute! Please read our contributing guide!
Acknowledgements
We could not do this work without the contributions of the community.
We appreciate all of you!
We want to thank:
- everyone who submits bug reports and feature requests
- everyone who contributes code
- everyone who contributes financially:
We also want to thank these organizations and people for making their tools available to Open Source maintainers:
No vulnerabilities found.
Reason
30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE.md:0
- Info: FSF or OSI recognized license: MIT No Attribution: LICENSE.md:0
Reason
no binaries found in the repo
Reason
1 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Reason
SAST tool detected but not run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Warn: 0 commits out of 7 are checked with a SAST tool
Reason
dependency not pinned by hash detected -- score normalized to 3
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/codeql.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-preset-env.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/deploy-preset-env.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-preset-env.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/deploy-preset-env.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/labeler.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/labeler.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/csstools/postcss-plugins/test.yml/main?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/test.yml:90
- Info: 0 out of 11 GitHub-owned GitHubAction dependencies pinned
- Info: 6 out of 7 npmCommand dependencies pinned
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'allow deletion' disabled on branch 'main'
- Info: 'force pushes' disabled on branch 'main'
- Info: 'branch protection settings apply to administrators' is required to merge on branch 'main'
- Warn: could not determine whether codeowners review is allowed
- Warn: no status checks found to merge onto branch 'main'
- Warn: PRs are not required to make changes on branch 'main'; or we don't have data to detect it.If you think it might be the latter, make sure to run Scorecard with a PAT or use Repo Rules (that are always public) instead of Branch Protection settings
Reason
Found 1/27 approved changesets -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/codeql.yml:1
- Warn: no topLevel permission defined: .github/workflows/deploy-preset-env.yml:1
- Warn: no topLevel permission defined: .github/workflows/labeler.yml:1
- Warn: no topLevel permission defined: .github/workflows/lint.yml:1
- Warn: no topLevel permission defined: .github/workflows/test.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Score
5.8
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More