PostCSS Logical underwent significant updates moving from version 3.0.0 to 4.0.0. Both versions empower developers to utilize logical properties and values within their CSS, improving layout adaptability across different writing modes and directionalities. A key difference lies in the dependency versions; version 4.0.0 upgrades the core postcss dependency to "^7.0.16", from "^7.0.2" in the older version, likely incorporating bug fixes and performance improvements from the PostCSS ecosystem. The development environment also saw substantial updates. Version 4.0.0 utilizes newer versions of tools like eslint, @babel/core, @babel/preset-env, and rollup-plugin-babel, ensuring compatibility with modern JavaScript features and linting standards. Notably, version 4.0.0 removes the eslint-config-dev dependency, potentially streamlining the development workflow. The postcss-tape version also jumped from 2.2.0 to 5.0.0 highlighting some important changes in testing approach or features enhancement, potentially. While both versions share the same permissive CC0-1.0 license and are authored by Jonathan Neal, the updated dependencies in version 4.0.0 suggest a move toward stability, alignment with current tooling standards and better integration with recent PostCSS updates. Developers should consider upgrading to version 4.0.0 to benefit from these refinements and to ensure continued compatibility with the evolving web development landscape. The unpacked size of version 4.0.0 is also slightly lower (157371) than version 3.0.0 (180876) so the newer library might be slightly more performant.
All the vulnerabilities related to the version 4.0.0 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
