Autoprefixer version 9.6.2 introduces subtle but important updates compared to its predecessor, version 9.6.1. Both versions serve the core purpose of parsing CSS and automatically adding vendor prefixes to ensure compatibility across different web browsers, leveraging data from the "Can I Use" website. This functionality is crucial for developers aiming to write clean, standardized CSS code without manually managing browser-specific prefixes.
The key differences lie in the updated dependencies. Version 9.6.2 bumps several core dependencies. postcss gets updated from version 7.0.17 to 7.0.18, likely including bug fixes and performance improvements within the PostCSS ecosystem. browserslist moves from version 4.6.3 to 4.7.0, meaning enhanced browser support detection. More importantly, caniuse-lite, the data source for browser compatibility information, is upgraded from version 1.0.30000980 to 1.0.30000998 representing the changes in browser support for different CSS features. Finally postcss-value-parser is updated from 4.0.0 to 4.0.2. These updates ensure Autoprefixer remains current with the evolving browser landscape, providing developers with the most accurate and up-to-date prefixing. The updated caniuse-lite is important because that is the main functionality for autoprefixer. The release date difference also indicates a three-month gap, making 9.6.2 a more recent and likely more reliable choice. Developers should upgrade to benefit from these improvements, especially those prioritizing broad browser compatibility and adherence to the latest web standards. The changes in sizes also shows that there were changes in the code.
All the vulnerabilities related to the version 9.6.2 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
