PostCSS 8.3.0 brings subtle yet impactful changes compared to its predecessor, version 8.2.15. Both versions serve as powerful tools for transforming styles using JavaScript plugins, enabling developers to automate CSS tasks, enhance code quality, and improve front-end performance. Key features like a robust plugin ecosystem, custom syntax support, and source map generation remain central. However, comparing the JSON description reveals a key difference in dependencies. Version 8.3.0 upgrades the source-map dependency to source-map-js "^0.6.2" which replace the old source-map: "^0.6.1" . While seemingly minor, this change indicates a potential optimization or bug fix tied to source map handling, critical for debugging and maintaining CSS codebases, especially in larger projects. The file size and unpacked size also grew a bit in the new version. For developers, this might indicate new functionalities, improvement of existing ones as well as bug fixes.The update from 8.2.15 to 8.3.0 also sees a slight increase in the tarball's file count (from 49 to 51). This could suggest additions to core functionality improved documentation, or test suites. Furthermore, the release date difference of approximately 11 days highlights the continued active development and maintenance of PostCSS. Developers should evaluate this change to ensure compatibility and leverage any improvements in source map accuracy or performance offered by the new dependency.
All the vulnerabilities related to the version 8.3.0 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
