Autoprefixer, a widely-used tool for automatically adding vendor prefixes to CSS rules, released version 9.8.8 on October 4th, 2021, following version 9.8.7 which was released on September 26th, 2021. Both versions share the same core functionality: parsing CSS and applying necessary prefixes based on data from the Can I Use website, ensuring compatibility across different browsers. A key interesting difference is the changed dependency. Version 9.8.8 replaces nanocolors with picocolors for console output coloring, suggesting a possible performance or compatibility improvement in handling terminal colors. Both versions rely on crucial dependencies such as postcss for CSS parsing, browserslist for browser compatibility configuration, and caniuse-lite for up-to-date browser support data. Developers using Autoprefixer can expect consistent prefixing behavior between these versions. Noticeable is the unpackedSize difference, with version 9.8.8 being smaller. For those concerned with package size that might be important. The switch to picocolors in version 9.8.8 is the primary change to consider. Developers might want to investigate the implications of this change in their specific development environments or build processes if they directly interact with console output from Autoprefixer. Both versions are licensed under MIT, ensuring broad usability, and are supported by Tidelift funding.
All the vulnerabilities related to the version 9.8.8 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
