Autoprefixer version 9.8.2 is a minor update to the popular CSS vendor prefixing tool, building upon version 9.8.1. Both versions share the same core functionality: parsing CSS and automatically adding vendor prefixes based on data from the "Can I Use" website. This ensures compatibility across different browsers, including older versions, saving developers time and effort in manually managing prefixes. Key dependencies like postcss for CSS parsing, browserslist for targeting specific browser versions, and caniuse-lite for browser compatibility data remain consistent between the two versions. The licensing, repository information, author details and funding information are also the same in both releases.
The crucial differences between 9.8.2 and 9.8.1 lie in incremental improvements and bug fixes. While the dependency versions are identical, a slight change in the unpacked size of the distribution archive, from 348754 to 348870, hints at internal code refinements. Furthermore, the newer version was released on "2020-06-21", a couple of days later than the stable version "2020-06-19", indicating the bug fixes and incremental changes. For developers, upgrading to 9.8.2 is recommended to benefit from the latest optimizations and potential resolutions to any minor issues present in 9.8.1, fostering a smoother and more reliable prefixing experience. This provides a consistent toolset to allow developer to focus on the business logic and application code.
All the vulnerabilities related to the version 9.8.2 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
