PostCSS version 8.4.18 is a minor update to the popular JavaScript tool for transforming styles with plugins, building upon version 8.4.17. Both versions, licensed under MIT, share the same core dependencies: nanoid for unique ID generation, picocolors for enhanced terminal styling, and source-map-js for robust source map handling. This consistency ensures a stable foundation for developers relying on these features. The author and funding models remain the same, showcasing ongoing community support via Open Collective and Tidelift.
The key distinction lies in the details of the distribution package. PostCSS 8.4.18 boasts a slightly larger unpacked size of 187080 bytes, compared to 186908 bytes in version 8.4.17, potentially incorporating minor bug fixes, performance improvements, or updated documentation. Crucially, both versions maintain the same file count of 54, indicating that the update doesn't introduce new files, but rather tweaks existing ones. The release date separates the two, with version 8.4.18 being released on October 12, 2022, while version 8.4.17 was released on September 30, 2022 , indicating a relatively short period between updates. Developers should consult the PostCSS changelog for a comprehensive list of specific changes, especially if they experienced issues in 8.4.17, as this minor release could address them. For new projects, using the latest version is generally recommended. It's important for developers to keep up-to-date with the latest releases to guarantee access to the most recent features and improvements.
All the vulnerabilities related to the version 8.4.18 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
