Autoprefixer version 9.7.2 represents a subtle but important update to the popular CSS prefixing tool, building upon version 9.7.1. Both versions share the core functionality of parsing CSS and automatically adding vendor prefixes based on data from the "Can I Use" website, ensuring compatibility across different browsers. Developers can rely on Autoprefixer to streamline their workflow and avoid the need for manually managing browser-specific prefixes, leading to cleaner and more maintainable stylesheets. Key dependencies like chalk, num2fraction, normalize-range, and postcss-value-parser remain consistent between the two versions, indicating a focus on stability and core functionality.
The notable changes lie within the dependency updates: postcss moves from version 7.0.21 to 7.0.23 and browserslist increases from 4.7.2 to 4.7.3. The caniuse-lite data also sees an update from 1.0.30001006 to 1.0.30001010. These updated dependencies likely introduce bug fixes, performance improvements, and potentially new browser support information. The increase in the unpacked size from 337,286 to 340,395 suggests the addition of new data or code, probably related to the caniuse-lite update with the latest browser support and features. For developers, upgrading to 9.7.2 provides the benefit of the most current browser compatibility data and potential improvements within postcss and browserslist, ensuring that their CSS is optimally prefixed for the widest range of users. The release date reflects a relatively rapid update cycle, highlighting ongoing maintenance and improvements to this valuable tool.
All the vulnerabilities related to the version 9.7.2 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
