Autoprefixer version 9.8.7 represents a subtle but important update compared to its predecessor, version 9.8.6. Both versions share the core functionality of parsing CSS and adding vendor prefixes based on data from Can I Use, streamlining cross-browser compatibility for developers. They share dependencies such as postcss, browserslist, caniuse-lite, num2fraction, normalize-range, and postcss-value-parser, which are essential for its operation. However, a key difference lies in the dependency colorette in version 9.8.6 being replaced by nanocolors in version 9.8.7. This suggests a potential shift in how the package handles console output styling, possibly indicating improvements in performance or reduced bundle size related to color management and terminal output. Additionally, the dist section shows that version 9.8.7 has a smaller unpacked size (318890) and fewer files (79) than version 9.8.6 (349216 and 80 respectively.) This might reflect underlying efficiency improvements in the new version. Developers looking to minimise their project's dependencies or optimize overall size might find upgrading to version 9.8.7 beneficial. The core functionality remains consistent, ensuring a smooth transition whilst potentially benefitting from these refinements. Both versions are licensed under MIT and actively funded by Tidelift, which shows it's a secure open-source project to use.
All the vulnerabilities related to the version 9.8.7 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
