Autoprefixer versions 9.4.8 and 9.4.7 are both tools designed to automatically add vendor prefixes to CSS rules, ensuring cross-browser compatibility based on data from "Can I Use". Both versions, licensed under MIT, rely on core dependencies such as postcss for CSS parsing and transformation, browserslist for determining target browsers, num2fraction for converting numbers to fractions, normalize-range, and postcss-value-parser. Both of them share the same author.
The key difference lies in the caniuse-lite dependency. Version 9.4.8 utilizes caniuse-lite version ^1.0.30000938, whereas 9.4.7 uses ^1.0.30000932. This indicates an update to the browser compatibility data, meaning 9.4.8 includes more recent information about which browsers support specific CSS features. Developers using Autoprefixer should prioritize the newer version (9.4.8) to benefit from the most up-to-date browser support data, leading to more accurate and comprehensive prefixing. This ensures their CSS works seamlessly across a wider range of browsers, especially newer ones. Furthermore, while the file count is the same, the unpacked size is slightly smaller in version 9.4.8, potentially indicating minor optimizations or changes in internal structure, though this difference is arguably negligible for most users. Version 9.4.8 was released on February 20, 2019, while 9.4.7 was released on January 28, 2019.
All the vulnerabilities related to the version 9.4.8 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
