PostCSS version 8.4.12 is a minor update to the widely used CSS transformation tool, building upon version 8.4.11. Both versions share the same core functionality, serving as a robust engine for processing CSS with JavaScript plugins. They depend on the same core dependencies: nanoid for generating unique IDs, picocolors for colorful console output, and source-map-js for accurate source map generation. The license remains MIT, ensuring broad usability. The author and funding information also remain unchanged.
The key distinctions between the two versions lie in their release date and potentially minor bug fixes or performance improvements. Version 8.4.12 was released on March 16, 2022, a day after 8.4.11 (March 15, 2022). A practical difference is the slightly increased unpacked size which increased by 1 byte to a total of 186441. For developers, this incremental update suggests a refinement of the existing features rather than a substantial overhaul. Users already on 8.4.11 can likely upgrade to 8.4.12 with minimal risk of breaking changes, benefiting from any subtle enhancements or patches. When upgrading, consulting the PostCSS changelog is advisable to get more detail on the specific changes contained within this version, as they are not explicitly detailed in the JSON metadata. PostCSS continues to offer a powerful, plugin-driven architecture for modern CSS workflows.
All the vulnerabilities related to the version 8.4.12 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
