PostCSS 8.4.4 is a minor patch release improving upon version 8.4.3 of this popular tool for transforming styles with JavaScript plugins. Both versions share the same core dependencies: nanoid for generating unique IDs, picocolors for adding color to console output, and source-map-js for robust source map handling. This ensures consistent core functionality for developers regardless of which minor version they choose. Both versions are licensed under the permissive MIT license and supported by the same author and funding structure.
The notable difference between the two versions lies in the dist object where unpackedSize is slightly increased from 185581 to 185612. Release date is also different, 8.4.4 was released the day after 8.4.3. Such a close release date suggests that 8.4.4 likely addresses a bug fix or minor refinement identified shortly after the release of 8.4.3.
For developers already using PostCSS 8.4.3, upgrading to 8.4.4 is recommended to benefit from these potential improvements. Given the shared dependencies and minimal changes, the upgrade is expected to be smooth with minimal risk of breaking changes. For new users, 8.4.4 is the preferred starting point, representing the latest stable release with all known fixes incorporated. While PostCSS itself isn't a dependency visible in the browser, it offers powerful capabilities in pre-processing CSS, like vendor prefixes for optimal compatibility across browsers. So, it might be worth considering in your existing projects.
All the vulnerabilities related to the version 8.4.4 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
