PostCSS Logical has undergone a significant update from version 1.1.1 to 2.0.0, primarily focusing on modernization and compatibility with newer toolchains. One of the key changes developers should note is the peer dependency on postcss, which has been upgraded from version ^6.0.20 to ^7.0.2. This ensures compatibility with more recent PostCSS versions and their ecosystem of plugins.
The development dependencies also reflect a shift towards newer versions of build and linting tools. Babel, the JavaScript transpiler, sees a major update with @babel/core moving from the older babel-core version ^6.26.0 to ^7.0.0 and @babel/preset-env bumping from ^1.6.1 to ^7.0.0. This unlocks access to modern JavaScript features and improved transpilation. Rollup, the module bundler, is also updated from ^0.57.1 to ^0.66.0, potentially bringing performance improvements and new bundling options. Further, the update includes changes in eslint and the associated plugins.
Crucially, the unpacked size of the package has more than doubled, suggesting either additional features, more comprehensive test suites or more complete documentation. While both versions share the same license (CC0-1.0) and maintain the same author and repository, these dependency upgrades in version 2.0.0 are crucial for developers using the latest PostCSS and JavaScript tooling. Developers should test their existing PostCSS configurations against the new major version.
All the vulnerabilities related to the version 2.0.0 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
