Autoprefixer version 9.5.0 introduces subtle yet significant improvements over its predecessor, version 9.4.10, making it a worthwhile upgrade for developers seeking optimal CSS prefixing. Both versions share the core functionality of parsing CSS and applying vendor prefixes based on data from "Can I Use," ensuring compatibility across various browsers. Key dependencies like postcss, browserslist, num2fraction, normalize-range, and postcss-value-parser remain consistent, indicating a stable foundation.
The primary difference lies in the updated caniuse-lite dependency. Version 9.5.0 uses caniuse-lite version ^1.0.30000947 while version 9.4.10 relies on ^1.0.30000940. This update is crucial as caniuse-lite provides the data on browser support for various CSS features. Newer versions signify broader and more accurate browser compatibility information. Developers benefit from enhanced prefixing, targeting a more precise range of browsers that require vendor prefixes, ultimately leading to smaller and more efficient CSS files. The package size also saw a slight increase, growing by approximately 3KB unpacked; a minor alteration likely related to the caniuse-lite database expansion. Version 9.5.0 also has one more file count. This also impacts SEO: the changes, while slight, allow developers to serve optimized and lightweight code. Finally, the difference in release date shows that the newer version came out almost 10 days after.
All the vulnerabilities related to the version 9.5.0 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
