PostCSS 8.3.5 is a minor version update to the popular PostCSS tool, designed for transforming styles with JavaScript plugins. Building upon version 8.3.4, both versions share the same core functionality, including dependencies on nanoid, colorette, and source-map-js for unique ID generation, colorful console output, and source map support, respectively. Both versions are licensed under the MIT license and maintained by Andrey Sitnik, with funding supported through Open Collective. The core function of PostCSS as described in the description, remained the same across both updates.
However, a key difference lies in the dist section. While both distributions contain 51 files and are packaged as gzipped tarballs on npm, the unpacked size of version 8.3.5 is slightly larger at 188,802 bytes, compared to 188,783 bytes in version 8.3.4. This suggests a minor change in the codebase, potentially a bug fix, performance improvement, or documentation update. Most importantly, the release date is different, since the 8.3.5 came three days after the other.
Developers should consider upgrading to version 8.3.5 to benefit from these potential improvements. While the changes may be subtle, staying up-to-date ensures access to the latest refinements and bug fixes, contributing to a more stable and efficient workflow when using PostCSS for CSS transformations. The impact of the new version must be low as the changes involved were minimal, not including changes in the dependencies.
All the vulnerabilities related to the version 8.3.5 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
