Skip to content

Bump postcss-selector-parser, postcss-modules-local-by-default, postcss-modules-scope, postcss-discard-comments, stylehacks, postcss-merge-rules, postcss-minify-selectors and postcss-unique-selectors - #1181

Merged
stephaniehobson merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d07f3dd4d0
Oct 16, 2026

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Bumps postcss-selector-parser, postcss-modules-local-by-default, postcss-modules-scope, postcss-discard-comments, stylehacks, postcss-merge-rules, postcss-minify-selectors and postcss-unique-selectors. These dependencies needed to be updated together.
Updates postcss-selector-parser from 6.1.4 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

  • fix: tolerate non-node children when serializing selectors

7.1.3

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

v7.1.1

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

  • feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

  • Feat: make insertions during iteration safe (major)
Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

7.1.0

  • feat: insert(Before|After) support multiple new node

7.0.0

  • Feat: make insertions during iteration safe (major)

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

6.1.1

  • Fixed: improve typings of constructor helpers (#292)

6.1.0

  • Feature: add sourceIndex to Selector nodes (#290)

6.0.16

... (truncated)

Commits
  • 4eb3468 7.1.6
  • 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
  • e33e9bc 7.1.5
  • 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
  • 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
  • e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
  • dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
  • 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
  • See full diff in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates postcss-modules-local-by-default from 4.0.5 to 4.2.0

Release notes

Sourced from postcss-modules-local-by-default's releases.

v4.2.0

4.2.0 - 2024-12-11

  • feat: add support a /* cssmodules-pure-no-check */ comment

v4.1.0

4.1.0 - 2024-11-11

  • feat: add global() and local() for animations
  • feat: add pure ignore comment
  • fix: css nesting and pure mode
Changelog

Sourced from postcss-modules-local-by-default's changelog.

4.2.0 - 2024-12-11

  • feat: add support a /* cssmodules-pure-no-check */ comment

4.1.0 - 2024-11-11

  • feat: add global() and local() for animations
  • feat: add pure ignore comment
  • fix: css nesting and pure mode
Commits
  • db195e7 chore(release): 4.2.0
  • ba7e8ef feat: added support a cssmodules-pure-no-check comment
  • 39a2f78 docs: fix (#83)
  • e489ff8 chore(release): 4.1.0
  • 3811927 fix: css nesting and pure mode
  • 582bd9e chore: postcss-selector-parser (#81)
  • 9d07eeb feat: add pure ignore comment for CSS Modules (#80)
  • fde62d7 feat: add global and local for animations (#76)
  • a73b700 test: for current pure logic (#74)
  • f1c05a5 test: enhanced test cases to prepare for CSS declaration-level processing (#77)
  • See full diff in compare view

Updates postcss-modules-scope from 3.2.0 to 3.2.1

Release notes

Sourced from postcss-modules-scope's releases.

v3.2.1

3.2.1

Chore

  • update postcss-selector-parser
Changelog

Sourced from postcss-modules-scope's changelog.

3.2.1

Chore

  • update postcss-selector-parser
Commits

Updates postcss-discard-comments from 7.0.3 to 7.0.8

Release notes

Sourced from postcss-discard-comments's releases.

cssnano@7.0.7

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.0.6...cssnano@7.0.7

v7.0.6

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.0.5...cssnano@7.0.6

v7.0.5

Bug Fixes

v7.0.4

Bug fixes

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss-discard-comments since your current version.


Updates stylehacks from 7.0.4 to 7.0.11

Release notes

Sourced from stylehacks's releases.

cssnano@7.0.7

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.0.6...cssnano@7.0.7

v7.0.6

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.0.5...cssnano@7.0.6

v7.0.5

Bug Fixes

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for stylehacks since your current version.


Updates postcss-merge-rules from 7.0.4 to 7.0.11

Release notes

Sourced from postcss-merge-rules's releases.

cssnano@7.0.7

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.0.6...cssnano@7.0.7

v7.0.6

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.0.5...cssnano@7.0.6

v7.0.5

Bug Fixes

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss-merge-rules since your current version.


Updates postcss-minify-selectors from 7.0.4 to 7.1.2

Release notes

Sourced from postcss-minify-selectors's releases.

v7.1.2

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.1...cssnano@7.1.2

v71.1.1

Bug Fixes

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.0...cssnano@7.1.1

cssnano@7.1.0

Changes

  • Update to SVGO 4.0
  • Update browserslist

cssnano@7.0.7

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.0.6...cssnano@7.0.7

v7.0.6

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.0.5...cssnano@7.0.6

v7.0.5

Bug Fixes

Commits
  • 2069407 Publish cssnano 7.1.9
  • fc0c79d fix(postcss-minify-selectors): reject :is() fold for unknown pseudo-classes w...
  • d9fee3b chore: enforce TypeScript isolated modules
  • d6c96c4 chore: update development deps
  • 709f16a docs: update website depenencies
  • ed403db Publish cssnano 7.1.8
  • 7e56dba fix: update postcss
  • d1780fd fix: update @​colordx-core
  • 0005443 chore: add changeset
  • bedd609 fix(postcss-minify-selectors): reject :is() fold for :nth-child(... of S) to ...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss-minify-selectors since your current version.


Updates postcss-unique-selectors from 7.0.3 to 7.0.7

Release notes

Sourced from postcss-unique-selectors's releases.

cssnano@7.0.7

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.0.6...cssnano@7.0.7

v7.0.6

What's Changed

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.0.5...cssnano@7.0.6

v7.0.5

Bug Fixes

v7.0.4

Bug fixes

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss-unique-selectors since your current version.


@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 12, 2026
@stephaniehobson

Copy link
Copy Markdown
Contributor

@dependabot recreate

…ss-modules-scope, postcss-discard-comments, stylehacks, postcss-merge-rules, postcss-minify-selectors and postcss-unique-selectors

Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser), [postcss-modules-local-by-default](https://github.com/css-modules/postcss-modules-local-by-default), [postcss-modules-scope](https://github.com/css-modules/postcss-modules-scope), [postcss-discard-comments](https://github.com/cssnano/cssnano), [stylehacks](https://github.com/cssnano/cssnano), [postcss-merge-rules](https://github.com/cssnano/cssnano), [postcss-minify-selectors](https://github.com/cssnano/cssnano) and [postcss-unique-selectors](https://github.com/cssnano/cssnano). These dependencies needed to be updated together.

Updates `postcss-selector-parser` from 6.1.4 to 7.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@6.1.4...7.1.6)

Updates `postcss-modules-local-by-default` from 4.0.5 to 4.2.0
- [Release notes](https://github.com/css-modules/postcss-modules-local-by-default/releases)
- [Changelog](https://github.com/css-modules/postcss-modules-local-by-default/blob/master/CHANGELOG.md)
- [Commits](css-modules/postcss-modules-local-by-default@v4.0.5...v4.2.0)

Updates `postcss-modules-scope` from 3.2.0 to 3.2.1
- [Release notes](https://github.com/css-modules/postcss-modules-scope/releases)
- [Changelog](https://github.com/css-modules/postcss-modules-scope/blob/master/CHANGELOG.md)
- [Commits](css-modules/postcss-modules-scope@v3.2.0...v3.2.1)

Updates `postcss-discard-comments` from 7.0.3 to 7.0.8
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/compare/postcss-discard-comments@7.0.3...postcss-discard-comments@7.0.8)

Updates `stylehacks` from 7.0.4 to 7.0.11
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/compare/stylehacks@7.0.4...stylehacks@7.0.11)

Updates `postcss-merge-rules` from 7.0.4 to 7.0.11
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/compare/postcss-merge-rules@7.0.4...postcss-merge-rules@7.0.11)

Updates `postcss-minify-selectors` from 7.0.4 to 7.1.2
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/compare/postcss-minify-selectors@7.0.4...postcss-minify-selectors@7.1.2)

Updates `postcss-unique-selectors` from 7.0.3 to 7.0.7
- [Release notes](https://github.com/cssnano/cssnano/releases)
- [Commits](https://github.com/cssnano/cssnano/compare/postcss-unique-selectors@7.0.3...postcss-unique-selectors@7.0.7)

---
updated-dependencies:
- dependency-name: postcss-discard-comments
  dependency-version: 7.0.8
  dependency-type: indirect
- dependency-name: postcss-merge-rules
  dependency-version: 7.0.11
  dependency-type: indirect
- dependency-name: postcss-minify-selectors
  dependency-version: 7.1.2
  dependency-type: indirect
- dependency-name: postcss-modules-local-by-default
  dependency-version: 4.2.0
  dependency-type: indirect
- dependency-name: postcss-modules-scope
  dependency-version: 3.2.1
  dependency-type: indirect
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
- dependency-name: postcss-unique-selectors
  dependency-version: 7.0.7
  dependency-type: indirect
- dependency-name: stylehacks
  dependency-version: 7.0.11
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-d07f3dd4d0 branch from 1f6517c to e6672e4 Compare October 16, 2026 21:21
@stephaniehobson
stephaniehobson merged commit 51d6d93 into main Oct 16, 2026
4 checks passed
@stephaniehobson
stephaniehobson deleted the dependabot/npm_and_yarn/multi-d07f3dd4d0 branch October 16, 2026 21:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant