Autoprefixer is a widely-used PostCSS plugin that automatically adds vendor prefixes to CSS rules, ensuring compatibility across different browsers. Comparing versions 9.4.2 and 9.4.3 reveals subtle but important updates for developers seeking robust CSS prefixing. The core functionality remains consistent: analyzing CSS using the "Can I Use" database to apply necessary prefixes, saving developers from manually managing browser compatibility.
The key changes lie in dependency updates. Version 9.4.3 upgrades the browserslist dependency from 4.3.5 to 4.3.6 and the caniuse-lite dependency from 1.0.30000914 to 1.0.30000921. These upgrades indicate improvements in browser support detection and the availability of up-to-date data from "Can I Use." Developers benefit as Autoprefixer gains recognition of newer browser versions and features, leading to more accurate and comprehensive prefixing. The caniuse-lite update is especially critical since it is the source of browser support data driving Autoprefixer's prefixing decisions, guaranteeing compatibility. Also, the increment of the unpacked size is neglectable, so the bundle size won't increase significantly. For developers focused on a seamless and current CSS workflow, these updates deliver enhanced reliability and future-proofing. Autoprefixer remains a valuable tool, streamlining CSS development and reducing cross-browser inconsistencies, improved by the updated data.
All the vulnerabilities related to the version 9.4.3 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
