PostCSS Import version 12.0.0 is a significant update of the popular PostCSS plugin that enables modular CSS development through @import directives. This release, dating back to August 2018, brings key improvements over its predecessor, version 11.1.0 (released in February 2018). A primary difference lies in its peer dependency: version 12.0.0 now requires PostCSS version 7.0.1 or higher, while the older version was compatible with PostCSS 6.0.1 or higher. This update aligns the plugin with newer PostCSS features and performance optimizations, which can translate to a better overall CSS processing workflow for developers.
The development dependencies also see some notable updates, reflecting improvements in code quality and tooling. ESLint jumps from version 4.16.0 to 5.0.0, and Prettier updates from version 1.10.2 to 1.14.0, suggesting a focus on code styling and consistency. Furthermore, eslint-config-i-am-meticulous moves from version 8.0.0 to 11.0.0, showing updates in linting rules. Although both versions share similar core dependencies like resolve, read-cache, and postcss-value-parser, the jump in dev dependencies versions in 12.0.0 indicates a move towards more modern development practices and better code maintainability. Users upgrading should ensure their PostCSS environment meets the updated peer dependency requirement. Ultimately, this upgrade offers improved performance and compatibility with the latest PostCSS ecosystem.
All the vulnerabilities related to the version 12.0.0 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
