[dependabot]

Bumps postcss-selector-parser, postcss-modules-local-by-default and postcss-modules-scope. These dependencies needed to be updated together.
Updates postcss-selector-parser from 6.0.4 to 7.1.7

Release notes

Sourced from postcss-selector-parser's releases.

7.1.7

• fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @​theRizwan)
• fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @​jakezwang)
• fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @​feritcemkahraman)
• fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @​SAY-5)
• fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @​dkryaklin)

7.1.6

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

• fix: tolerate non-node children when serializing selectors

7.1.3

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @​MoOx)

v7.1.1

7.1.1

• perf: replace startsWith with strict equality (#308)
• fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

• feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

• Feat: make insertions during iteration safe (major)

6.1.5

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#346 by @​bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind

... (truncated)

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.7 - 2026-10-19

• fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @​theRizwan)
• fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @​jakezwang)
• fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @​feritcemkahraman)
• fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @​SAY-5)
• fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @​dkryaklin)

7.1.6 - 2026-09-03

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

• fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @​MoOx)

7.1.1

• perf: replace startsWith with strict equality (#308)
• fix(types): add walkUniversal declaration (#311)

7.1.0

• feat: insert(Before|After) support multiple new node

7.0.0

• Feat: make insertions during iteration safe (major)

6.1.2

• Fixed: erroneous trailing combinators in pseudos

6.1.1

... (truncated)

Commits

• 154c2b0 7.1.7
• e8dc65f docs: add CVE-2026-104844 to the 7.1.6 changelog entry
• d5122b0 fix: keep whitespace around the namespace separator in attribute selectors (#...
• 80ab254 fix: invalidate stale raw spelling on combinator value assignment (#342)
• ba353c7 fix: set parents for all variadic inserted nodes (#343)
• 8b2d16d Consume whitespace after hexadecimal CSS escapes (#340)
• 8f10b8d fix: lossless mode drops whitespace when a selector ends empty (#337)
• 15c2b45 chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 (#347)
• 4eb3468 7.1.6
• 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates postcss-modules-local-by-default from 4.0.0 to 4.2.0

Release notes

Sourced from postcss-modules-local-by-default's releases.

v4.2.0

4.2.0 - 2024-12-11

• feat: add support a /* cssmodules-pure-no-check */ comment

v4.1.0

4.1.0 - 2024-11-11

• feat: add global() and local() for animations
• feat: add pure ignore comment
• fix: css nesting and pure mode

v4.0.5

4.0.5 - 2024-04-03

Fixes

• don't break the @scope at-rule without params

v4.0.4

4.0.4 - 2024-01-17

Fixes

• handle @scope at-rule
• css nesting
• do not tread negative values as identifiers in the animation shorthand

v4.0.3

4.0.3 - 2023-05-23

Fixes

• fix: do not localize animation-name property with var and env functions

v4.0.2

4.0.2 - 2023-05-23

Fixes

• don't handle identifiers in nested function for the animation property

v4.0.1

4.0.1 - 2023-05-19

Fixes

• don't handle global values in animation and animation-name properties
• handle all possible identifiers in animation and animation-name properties
• fix bug with nested :global and :local in pseudo selectors

Changelog

Sourced from postcss-modules-local-by-default's changelog.

4.2.0 - 2024-12-11

• feat: add support a /* cssmodules-pure-no-check */ comment

4.1.0 - 2024-11-11

• feat: add global() and local() for animations
• feat: add pure ignore comment
• fix: css nesting and pure mode

4.0.5 - 2024-04-03

Fixes

• don't break the @scope at-rule without params

4.0.4 - 2024-01-17

Fixes

• handle @scope at-rule
• css nesting
• do not tread negative values as identifiers in the animation shorthand

4.0.3 - 2023-05-23

Fixes

• fix: do not localize animation-name property with var and env functions

4.0.2 - 2023-05-23

Fixes

• don't handle identifiers in nested function for the animation property

4.0.1 - 2023-05-19

Fixes

• don't handle global values in animation and animation-name properties
• handle all possible identifiers in animation and animation-name properties
• fix bug with nested :global and :local in pseudo selectors

Commits

• db195e7 chore(release): 4.2.0
• ba7e8ef feat: added support a cssmodules-pure-no-check comment
• 39a2f78 docs: fix (#83)
• e489ff8 chore(release): 4.1.0
• 3811927 fix: css nesting and pure mode
• 582bd9e chore: postcss-selector-parser (#81)
• 9d07eeb feat: add pure ignore comment for CSS Modules (#80)
• fde62d7 feat: add global and local for animations (#76)
• a73b700 test: for current pure logic (#74)
• f1c05a5 test: enhanced test cases to prepare for CSS declaration-level processing (#77)
• Additional commits viewable in compare view

Updates postcss-modules-scope from 3.0.0 to 3.2.1

Release notes

Sourced from postcss-modules-scope's releases.

v3.2.1

3.2.1

Chore

• update postcss-selector-parser

v3.2.0

3.2.0 - 2024-04-03

Features

• supports multiple composes, i.e. .class { composes: a b, global(c), d e from "./path/file.css" }

v3.1.2

3.1.2 - 2024-04-03

Fixes

• export a root and limit from the @scope at-rule

v3.1.1

3.1.1 - 2024-01-18

Fixes

• handle @scope at-rule
• fix CSS nesting logic

v3.1.0

3.1.0 - 2023-12-21

Fixes

• scoped class attribute

Feature

• pass a node to the generateExportEntry option

Changelog

Sourced from postcss-modules-scope's changelog.

3.2.1

Chore

• update postcss-selector-parser

3.2.0 - 2024-04-03

Features

• supports multiple composes, i.e. .class { composes: a b, global(c), d e from "./path/file.css" }

3.1.2 - 2024-04-03

Fixes

• export a root and limit from the @scope at-rule

3.1.1 - 2024-01-18

Fixes

• handle @scope at-rule
• fix CSS nesting logic

3.1.0 - 2023-12-21

Fixes

• scoped class attribute

Features

• pass a node to the generateExportEntry option

Commits

• 710d00e chore(release): 3.2.1
• bc9d3bb chore: update lock file (#64)
• be0c9f8 fix: update postcss-selector-parser (#63)
• 0fea4e6 chore(release): 3.2.0
• 0141278 feat: supports multiple composes (#62)
• ef877d0 chore(release): 3.1.2
• c8c3ee9 fix: export @​scope root and limit locals (#61)
• 2ef17a3 chore(release): 3.1.1
• f749cf2 fix: support css nesting and scope at-rule (#59)
• 50a2a77 chore(release): 3.1.0
• Additional commits viewable in compare view