Bump postcss and expo in /demo

[dependabot]

Bumps postcss to 8.5.26 and updates ancestor dependency expo. These dependencies need to be updated together.

Updates postcss from 8.4.49 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).

... (truncated)

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates expo from 53.0.20 to 57.0.12

Changelog

Sourced from expo's changelog.

Changelog

Unpublished

🛠 Breaking changes

• Raise minimum Node.js version to ^22.13.0 (#47202 by @​kitten)

🎉 New features

🐛 Bug fixes

• [iOS] Fix expo/fetch streaming race between URLSession delegate callbacks and startStreaming() that could deliver an empty body on a 200 response, drop chunks, or leave the body stream open. (#47796 by @​idoyana)
• Fix expo/fetch body-stream teardown races: aborting via an AbortSignal now rejects the in-flight read with an AbortError instead of hanging forever, and late native events no longer throw The stream is not in a state that permits enqueue/close from outside any consumer try/catch. (#47573 by @​idoyana)
• [iOS] Fix expo/fetch Response.text() and .arrayBuffer() never settling when the request fails (network drop, abort()) after the response was already delivered. (#48230 by @​zoontek)
• Fix iOS build against React Native 0.87+ by dropping the legacy architecture (bridge) RCTRootViewFactoryConfiguration setup. (#46641 by @​zoontek)
• Adopted the UIKit scene-based life cycle on iOS so apps built with the iOS 27 SDK launch correctly. (#46733 by @​alanjhughes)
• [iOS] Mark ExpoAppSceneDelegate as unavailable in extensions. (#46799 by @​jakex7)
• [iOS] Fix Linking.getInitialURL() returning null and deep links being dropped when a URL cold-starts an app on the UIKit scene life cycle. (#47628 by @​tsapeta)
• [iOS] Mark ExpoAppSceneDelegate as unavailable in iOSApplicationExtension for widgets. (#47894 by @​jakex7)
• [iOS] Add ExpoBundleConfiguration to derive RCTBundleConfiguration from the normalized bundle URL instead of default shared settings singleton (#48010 by @​kitten)
• [iOS] Resolve the dev server port from the RCTMetroPort Info.plist key at runtime so bare projects without expo-dev-client connect to their own Metro instance instead of defaulting to 8081. (#48098 by @​alanjhughes)
• Fix async imports (import(...)) via asyncRequireModule not a thenable instead of a full promise shape (#48550 by @​kitten)

💡 Others

• [Android] ExpoReactHostFactory now passes host handlers' DevSupportManagerFactory to ReactHostImpl. (#47637 by @​alanjhughes)
• [macOS] Fix build by guarding the bundleConfiguration override, which requires react-native 0.84+. (#48494 by @​intergalacticspacehighway)
• Restore RCTHostRuntimeDelegate conformance for react-native-macos (#46420 by @​gabrieldonadel)
• Add explicit react-native/Libraries/Core/InitializeCore import to native runtime entrypoint (#46344 by @​kitten)
• [Internal] Update logbox imports (#46640 by @​kitten)
• Re-export more expo-modules-core APIs (#45987 by @​Wenszel)
• Update URL and URLSearchParams implementation to support IDNA/TR-46 and improve performance. Spec-adherence has increased and few gaps should now be noticeable compared to browsers (#47813 by @​kitten)
• [Internal] Add getBundleOrigin, exposed as expo/internal/bundle-origin (#48275 by @​kitten)
• [Internal] Derive getDevServer from the bundle URL internally and expose getBundleUrl helper (#48278 by @​kitten)

57.0.9 - 2026-07-29

This version does not introduce any user-facing changes.

57.0.8 - 2026-07-22

🐛 Bug fixes

• [Android] Fixed expo-fetch race condition causing out-of-order delivery of initial chunks (#42161 by @​matthieugicquel)

57.0.7 - 2026-07-17

🐛 Bug fixes

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for expo since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.