Approximately 800 new packages are uploaded to the npm registry every day. This number can vary, but it reflects the active and growing nature of the JavaScript development community.
Installations
npm install postcssScore
97.1
Supply Chain Risk
80.2
Quality
93.2
Maintenance
100
Vulnerability
Releases
257
Contributors
387
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4){kind=avatar}
Developer
Statistics
28,437 Stars
4,091 Commits
1,556 Forks
512 Watching
5 Branches
387 Contributors
Updated on 09 Sept 2024
Bundle Size
49.47 kB
Minified
15.11 kB
Minified + Gzipped
Languages
TypeScript (58.6%)
JavaScript (41.4%)
Total Downloads
Cumulative downloads
Total Downloads
14,987,674,379
Last day
-8.3%
3,094,517
Compared to previous day
Last week
0.7%
70,765,098
Compared to previous week
Last month
-9.5%
279,971,579
Compared to previous month
Last year
-4.5%
3,486,126,288
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
3
Versions
PostCSS
PostCSS is a tool for transforming styles with JS plugins. These plugins can lint your CSS, support variables and mixins, transpile future CSS syntax, inline images, and more.
PostCSS is used by industry leaders including Wikipedia, Twitter, Alibaba, and JetBrains. The Autoprefixer and Stylelint PostCSS plugins is one of the most popular CSS tools.
Made at Evil Martians, product consulting for developer tools.
Sponsorship
PostCSS needs your support. We are accepting donations at Open Collective.
Plugins
PostCSS takes a CSS file and provides an API to analyze and modify its rules (by transforming them into an Abstract Syntax Tree). This API can then be used by plugins to do a lot of useful things, e.g., to find errors automatically, or to insert vendor prefixes.
Currently, PostCSS has more than 200 plugins. You can find all of the plugins in the plugins list. Below is a list of our favorite plugins — the best demonstrations of what can be built on top of PostCSS.
If you have any new ideas, PostCSS plugin development is really easy.
Solve Global CSS Problem
postcss-useallows you to explicitly set PostCSS plugins within CSS and execute them only for the current file.postcss-modulesandreact-css-modulesautomatically isolate selectors within components.postcss-autoresetis an alternative to using a global reset that is better for isolatable components.postcss-initialaddsall: initialsupport, which resets all inherited styles.cq-prolyfilladds container query support, allowing styles that respond to the width of the parent.
Use Future CSS, Today
autoprefixeradds vendor prefixes, using data from Can I Use.postcss-preset-envallows you to use future CSS features today.
Better CSS Readability
postcss-nestedunwraps nested rules the way Sass does.postcss-sortingsorts the content of rules and at-rules.postcss-utilitiesincludes the most commonly used shortcuts and helpers.shortadds and extends numerous shorthand properties.
Images and Fonts
postcss-urlpostcss plugin to rebase url(), inline or copy asset.postcss-spritesgenerates image sprites.font-magiciangenerates all the@font-facerules needed in CSS.postcss-inline-svgallows you to inline SVG and customize its styles.postcss-write-svgallows you to write simple SVG directly in your CSS.webp-in-cssto use WebP image format in CSS background.avif-in-cssto use AVIF image format in CSS background.
Linters
stylelintis a modular stylesheet linter.stylefmtis a tool that automatically formats CSS accordingstylelintrules.doiuselints CSS for browser support, using data from Can I Use.colorguardhelps you maintain a consistent color palette.
Other
cssnanois a modular CSS minifier.lostis a feature-richcalc()grid system.rtlcssmirrors styles for right-to-left locales.
Syntaxes
PostCSS can transform styles in any syntax, not just CSS. If there is not yet support for your favorite syntax, you can write a parser and/or stringifier to extend PostCSS.
sugarssis a indent-based syntax like Sass or Stylus.postcss-syntaxswitch syntax automatically by file extensions.postcss-htmlparsing styles in<style>tags of HTML-like files.postcss-markdownparsing styles in code blocks of Markdown files.postcss-styled-syntaxparses styles in template literals CSS-in-JS like styled-components.postcss-jsxparsing CSS in template / object literals of source files.postcss-styledparsing CSS in template literals of source files.postcss-scssallows you to work with SCSS (but does not compile SCSS to CSS).postcss-sassallows you to work with Sass (but does not compile Sass to CSS).postcss-lessallows you to work with Less (but does not compile LESS to CSS).postcss-less-engineallows you to work with Less (and DOES compile LESS to CSS using true Less.js evaluation).postcss-jsallows you to write styles in JS or transform React Inline Styles, Radium or JSS.postcss-safe-parserfinds and fixes CSS syntax errors.midasconverts a CSS string to highlighted HTML.
Articles
- Some things you may think about PostCSS… and you might be wrong
- What PostCSS Really Is; What It Really Does
- PostCSS Guides
More articles and videos you can find on awesome-postcss list.
Books
- Mastering PostCSS for Web Design by Alex Libby, Packt. (June 2016)
Usage
You can start using PostCSS in just two steps:
- Find and add PostCSS extensions for your build tool.
- Select plugins and add them to your PostCSS process.
CSS-in-JS
The best way to use PostCSS with CSS-in-JS is astroturf.
Add its loader to your webpack.config.js:
module.exports = { module: { rules: [ { test: /\.css$/, use: ['style-loader', 'postcss-loader'], }, { test: /\.jsx?$/, use: ['babel-loader', 'astroturf/loader'], } ] } }
Then create postcss.config.js:
/** @type {import('postcss-load-config').Config} */ const config = { plugins: [ require('autoprefixer'), require('postcss-nested') ] } module.exports = config
Parcel
Parcel has built-in PostCSS support. It already uses Autoprefixer
and cssnano. If you want to change plugins, create postcss.config.js
in project’s root:
/** @type {import('postcss-load-config').Config} */ const config = { plugins: [ require('autoprefixer'), require('postcss-nested') ] } module.exports = config
Parcel will even automatically install these plugins for you.
Please, be aware of the several issues in Version 1. Notice, Version 2 may resolve the issues via issue #2157.
Webpack
Use postcss-loader in webpack.config.js:
module.exports = { module: { rules: [ { test: /\.css$/, exclude: /node_modules/, use: [ { loader: 'style-loader', }, { loader: 'css-loader', options: { importLoaders: 1, } }, { loader: 'postcss-loader' } ] } ] } }
Then create postcss.config.js:
/** @type {import('postcss-load-config').Config} */ const config = { plugins: [ require('autoprefixer'), require('postcss-nested') ] } module.exports = config
Gulp
Use gulp-postcss and gulp-sourcemaps.
gulp.task('css', () => { const postcss = require('gulp-postcss') const sourcemaps = require('gulp-sourcemaps') return gulp.src('src/**/*.css') .pipe( sourcemaps.init() ) .pipe( postcss([ require('autoprefixer'), require('postcss-nested') ]) ) .pipe( sourcemaps.write('.') ) .pipe( gulp.dest('build/') ) })
npm Scripts
To use PostCSS from your command-line interface or with npm scripts
there is postcss-cli.
postcss --use autoprefixer -o main.css css/*.css
Browser
If you want to compile CSS string in browser (for instance, in live edit tools like CodePen), just use Browserify or webpack. They will pack PostCSS and plugins files into a single file.
To apply PostCSS plugins to React Inline Styles, JSS, Radium
and other CSS-in-JS, you can use postcss-js and transforms style objects.
const postcss = require('postcss-js') const prefixer = postcss.sync([ require('autoprefixer') ]) prefixer({ display: 'flex' }) //=> { display: ['-webkit-box', '-webkit-flex', '-ms-flexbox', 'flex'] }
Runners
- Grunt:
@lodder/grunt-postcss - HTML:
posthtml-postcss - Stylus:
poststylus - Rollup:
rollup-plugin-postcss - Brunch:
postcss-brunch - Broccoli:
broccoli-postcss - Meteor:
postcss - ENB:
enb-postcss - Taskr:
taskr-postcss - Start:
start-postcss - Connect/Express:
postcss-middleware - Svelte Preprocessor:
svelte-preprocess
JS API
For other environments, you can use the JS API:
const autoprefixer = require('autoprefixer') const postcss = require('postcss') const postcssNested = require('postcss-nested') const fs = require('fs') fs.readFile('src/app.css', (err, css) => { postcss([autoprefixer, postcssNested]) .process(css, { from: 'src/app.css', to: 'dest/app.css' }) .then(result => { fs.writeFile('dest/app.css', result.css, () => true) if ( result.map ) { fs.writeFile('dest/app.css.map', result.map.toString(), () => true) } }) })
Read the PostCSS API documentation for more details about the JS API.
All PostCSS runners should pass PostCSS Runner Guidelines.
Options
Most PostCSS runners accept two parameters:
- An array of plugins.
- An object of options.
Common options:
syntax: an object providing a syntax parser and a stringifier.parser: a special syntax parser (for example, SCSS).stringifier: a special syntax output generator (for example, Midas).map: source map options.from: the input file name (most runners set it automatically).to: the output file name (most runners set it automatically).
Treat Warnings as Errors
In some situations it might be helpful to fail the build on any warning
from PostCSS or one of its plugins. This guarantees that no warnings
go unnoticed, and helps to avoid bugs. While there is no option to enable
treating warnings as errors, it can easily be done
by adding postcss-fail-on-warn plugin in the end of PostCSS plugins:
module.exports = { plugins: [ require('autoprefixer'), require('postcss-fail-on-warn') ] }
Editors & IDE Integration
VS Code
csstools.postcssadds PostCSS support.
Sublime Text
Syntax-highlighting-for-PostCSSadds PostCSS highlight.
Vim
postcss.vimadds PostCSS highlight.
WebStorm
To get support for PostCSS in WebStorm and other JetBrains IDEs you need to install this plugin.
Security Contact
To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.
For Enterprise
Available as part of the Tidelift Subscription.
The maintainers of postcss and thousands of other packages are working
with Tidelift to deliver commercial support and maintenance for the open source
dependencies you use to build your applications. Save time, reduce risk,
and improve code health, while paying the maintainers of the exact dependencies
you use. Learn more.
Reason
30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
Found 8/24 approved changesets -- score normalized to 3
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/release.yml:7
- Info: topLevel 'contents' permission set to 'read': .github/workflows/test.yml:8
- Info: no jobLevel write permissions found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'main'
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/release.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:89: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:93: update your workflow using https://app.stepsecurity.io/secureworkflow/postcss/postcss/test.yml/main?enable=pin
- Info: 0 out of 9 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 5 third-party GitHubAction dependencies pinned
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 14 are checked with a SAST tool
Score
4.7
/10
Last Scanned on 2024-09-02
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreOther packages similar to postcss
postcss-import
16.1.0
PostCSS plugin to import CSS files
postcss-selector-parser
6.1.2
> Selector parser with built in methods for working with selector strings.
postcss-loader
8.1.1
PostCSS loader for webpack
autoprefixer
10.4.20
Parse CSS and add vendor prefixes to CSS rules using values from the Can I Use website