Autoprefixer version 9.8.1 introduces notable changes compared to its predecessor, version 9.8.0, primarily revolving around dependency updates and internal tooling. Both versions share the core functionality of parsing CSS and adding vendor prefixes based on data from the "Can I Use" website, easing cross-browser compatibility for developers. The key difference lies in the updated dependencies. Version 9.8.1 replaces chalk with kleur for terminal styling, potentially impacting the visual presentation of messages in a development environment, offering a more modern take in the terminal styling.
Furthermore, the postcss dependency is updated from version 7.0.30 to 7.0.32, pulling in bug fixes and improvements in PostCSS's core CSS processing capabilities. Most impactful perhaps is the update to caniuse-lite, jumping from version 1.0.30001061 to 1.0.30001084. This increment signifies that version 9.8.1 incorporates more recent browser compatibility data, providing developers with more accurate and up-to-date prefixing rules, improving the target of new browsers. While the core functionality largely remains the same, these dependency updates ensure developers using Autoprefixer benefit from the latest bug fixes, features, and browser support data in the CSS tooling ecosystem. Finally, the unpacked size of the package shows a slight increase, which can be often related to the updated dependencies.
All the vulnerabilities related to the version 9.8.1 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
