Autoprefixer 9.4.0 represents a minor version bump from 9.3.1, introducing key updates and improvements for developers leveraging this popular CSS prefixing tool. Both versions share the core functionality of parsing CSS and automatically adding vendor prefixes based on data from the "Can I Use" website, ensuring cross-browser compatibility. The description and licensing remain consistent between the versions, as well as the author, repository, and some dependencies.
A notable difference lies in the dependencies. Autoprefixer 9.4.0 updates postcss to version "^7.0.6" from "^7.0.5" in 9.3.1, and browserslist to "^4.3.5" from "^4.3.3". Crucially, caniuse-lite jumps from "^1.0.30000898" to "^1.0.30000912", signifying an updated database for browser support. This change directly impacts which prefixes are applied, reflecting the latest browser landscape and ensuring compatibility with emerging web standards.
Developers upgrading to 9.4.0 benefit from an enhanced and more current browser compatibility profile, translating to fewer manual prefixing tasks and more reliable cross-browser rendering. The dist metadata reveals that while both versions contain the same number of files (75), 9.4.0 has a slightly larger unpacked size (321955 vs. 304142), potentially indicating additions and updates within the core library or its dependencies. Finally, the increased releaseDate also showcases a more recent version.
All the vulnerabilities related to the version 9.4.0 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
