PostCSS 8.3.3 represents a minor update to the popular PostCSS tool, a JavaScript-based framework for transforming CSS with plugins. Comparing it to the previous stable version, 8.3.2, reveals subtle but potentially impactful changes for developers. Both versions share the same core dependencies, including nanoid for generating unique IDs, colorette for colored terminal output, and source-map-js for advanced source map handling, ensuring feature parity in those areas. They maintain the same MIT license and are backed by the same author and funding channels.
However, the dist object highlights key differences. Version 8.3.3 shows a slightly larger unpackedSize (188709 bytes) compared to 8.3.2 (188577 bytes), suggesting additions or modifications to the codebase. Furthermore, the releaseDate indicates that 8.3.3 was published on June 14, 2021, while 8.3.2 was released on June 11, 2021, making 8.3.3 a newer iteration. Developers should therefore investigate the changelog between these versions for specific bug fixes, performance improvements, or new features that account for the size difference and warrant an upgrade. While the file count remains the same, internal code adjustments likely contribute to the increased size and necessitate evaluating the benefits for their specific use case. Upgrading ensures access to the latest refinements and addresses any vulnerabilities patched in the newer release.
All the vulnerabilities related to the version 8.3.3 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
