Autoprefixer, a widely used PostCSS plugin for automatically adding vendor prefixes to CSS rules, saw a minor version bump from 9.1.3 to 9.1.4. Both versions share the same primary function: parsing CSS and applying necessary prefixes based on data from Can I Use, ensuring cross-browser compatibility. Core dependencies like postcss and postcss-value-parser remained consistent between the two versions. The primary change lies in its dependency updates. Version 9.1.4 updated the browserslist dependency from ^4.0.2 to ^4.1.0 and, more significantly, caniuse-lite from ^1.0.30000878 to ^1.0.30000884. The update to browserslist likely incorporated newer browser definitions and query syntax enhancements, while the caniuse-lite update brought in the latest browser compatibility data, impacting the prefixes Autoprefixer applies. Intriguingly, version 9.1.4 introduces a new dependency an addition of @babel/register (^7.0.0).
For developers, these updates translate into improved accuracy in prefixing, reflecting the most current browser landscape. By using Autoprefixer 9.1.4, developers can be assured that their CSS is being prefixed according to the latest browser support information. The inclusion of Babel Register might be for testing purposes and therefore not as important to most users of the package. The updated canisue-lite version is expected to allow correct CSS transformations for a larger share of target browsers. While the unpacked size decreased from 324505 to 287773 it doesn't reflect a decrease in capabilities.
All the vulnerabilities related to the version 9.1.4 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
