PostCSS 8.2.13 represents a minor update over its predecessor, version 8.2.12, in the popular CSS transformation tool. Both versions share the same core dependencies, including nanoid for generating unique IDs, colorette for colorful console output, and source-map for debugging compiled code. The license, repository details, author information, and funding avenues remain consistent between the two releases, indicating continued support and maintenance by the same team.
The primary difference lies in the release date, with version 8.2.13 published on April 26, 2021, while 8.2.12 was released on April 22, 2021. This suggests that 8.2.13 likely contains bug fixes, performance improvements, or other minor enhancements implemented in the intervening days. Interestingly, the unpackedSize of the newer version is slightly larger, growing from 180919 to 180969.
For developers using PostCSS, this update signifies a commitment to stability and ongoing refinement. While the core functionality remains unchanged, the small differences hint at optimizations under the hood. Users are encouraged to upgrade to the latest version to benefit from these potential improvements, ensuring they are running the most stable and efficient release available. Keeping up-to-date with minor versions like these allows developers to leverage the ongoing efforts of the PostCSS maintainers and enjoy a smoother, more reliable CSS transformation experience.
All the vulnerabilities related to the version 8.2.13 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
