[dependabot]

Bumps postcss-selector-parser to 7.1.6 and updates ancestor dependency @stylistic/stylelint-plugin. These dependencies need to be updated together.

Updates postcss-selector-parser from 6.1.4 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

• fix: tolerate non-node children when serializing selectors

7.1.3

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @​MoOx)

v7.1.1

7.1.1

• perf: replace startsWith with strict equality (#308)
• fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

• feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

• Feat: make insertions during iteration safe (major)

6.1.5

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#346 by @​bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6

... (truncated)

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

• fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @​MoOx)

7.1.1

• perf: replace startsWith with strict equality (#308)
• fix(types): add walkUniversal declaration (#311)

7.1.0

• feat: insert(Before|After) support multiple new node

7.0.0

• Feat: make insertions during iteration safe (major)

6.1.2

• Fixed: erroneous trailing combinators in pseudos

6.1.1

• Fixed: improve typings of constructor helpers (#292)

6.1.0

• Feature: add sourceIndex to Selector nodes (#290)

6.0.16

... (truncated)

Commits

• 4eb3468 7.1.6
• 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
• e33e9bc 7.1.5
• 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
• 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
• e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
• dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
• 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
• See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @stylistic/stylelint-plugin from 3.1.3 to 5.3.1

Release notes

Sourced from @​stylistic/stylelint-plugin's releases.

Release v5.3.1

Fixed

• The block-opening-brace-space-before rule no longer removes a comment standing between the selector and the opening brace when fixing (see #63).
• The indentation rule no longer damages a declaration whose multi-line value holds comments when fixing (see #62).
• The selector-combinator-space-before rule no longer reports a combinator that opens a selector when a comment stands in front of it (see #66).
• The indentation rule no longer raises the whole of a selector list by a level when one selector of it is a pseudo-class broken over several lines (see #74).
• The no-eol-whitespace rule now trims every line of a comment when fixing, and not only the lines up to the first quotation mark in it (see #67).
• The string-quotes rule no longer loses its bearings in a declaration's value or an at-rule's parameters holding a comment (see #61, #33).
• The at-rule-semicolon-newline-after rule no longer reports an at-rule whose semicolon is followed by a comment on a line of its own, and no longer breaks that comment's line when fixing (#748) (@​christianvuerings).

Release v5.3.0

Added

• The function-comma-newline-after rule now has an additional ignoreFunctions option (see #78).
• The function-comma-newline-before rule now has an additional ignoreFunctions option (see #81).
• The function-comma-space-after rule now has an additional ignoreFunctions option (see #82).
• The function-comma-space-before rule now has an additional ignoreFunctions option (see #83).

Release v5.2.1

Fixed

• The protocol in the repository's metadata URL now meets current requirements (#79) (@​BowenMilner).

Release v5.2.0

Added

• The declaration-block-semicolon-newline-before rule is now autofixable.

Fixed

• An exception for an empty custom property value has been added to the declaration-block-semicolon-newline-before and declaration-colon-space-after rules: the --custom-prop: ; and --custom-prop:; variants are now considered valid (see #50).

Release v5.1.0

Added

• The no-multiple-whitespaces rule, which disallows multiple whitespaces between property values and function arguments.

Fixed

• The dependencies have now been updated to versions that include security fixes.

Release v5.0.1

Fixed

• The selector-pseudo-class-parentheses-space-inside rule no longer triggers false positives in multiline pseudo-classes.

Release v5.0.0

Changed

• The plugin now requires:
  • stylelint version 17.0.0 or higher
  • node.js version 20.19.0 or higher

Release v4.0.1

Fixed

• Multiline pseudos are now aligned correctly with the @stylistic/indentation rule. Before:

  .foo:where(
  :not(

... (truncated)

Changelog

Sourced from @​stylistic/stylelint-plugin's changelog.

[5.3.1] — 2026–09–29

Fixed

• The block-opening-brace-space-before rule no longer removes a comment standing between the selector and the opening brace when fixing (see #63).
• The indentation rule no longer damages a declaration whose multi-line value holds comments when fixing (see #62).
• The selector-combinator-space-before rule no longer reports a combinator that opens a selector when a comment stands in front of it (see #66).
• The indentation rule no longer raises the whole of a selector list by a level when one selector of it is a pseudo-class broken over several lines (see #74).
• The no-eol-whitespace rule now trims every line of a comment when fixing, and not only the lines up to the first quotation mark in it (see #67).
• The string-quotes rule no longer loses its bearings in a declaration's value or an at-rule's parameters holding a comment (see #61, #33).
• The at-rule-semicolon-newline-after rule no longer reports an at-rule whose semicolon is followed by a comment on a line of its own, and no longer breaks that comment's line when fixing (#748) (@​christianvuerings).

[5.3.0] — 2026–08–09

Added

• The function-comma-newline-after rule now has an additional ignoreFunctions option (see #78).
• The function-comma-newline-before rule now has an additional ignoreFunctions option (see #81).
• The function-comma-space-after rule now has an additional ignoreFunctions option (see #82).
• The function-comma-space-before rule now has an additional ignoreFunctions option (see #83).

[5.2.1] — 2026–07–01

Fixed

• The protocol in the repository's metadata URL now meets current requirements (#79) (@​BowenMilner).

[5.2.0] — 2026–05–20

Added

• The declaration-block-semicolon-newline-before rule is now autofixable.

Fixed

• An exception for an empty custom property value has been added to the declaration-block-semicolon-newline-before and declaration-colon-space-after rules: the --custom-prop: ; and --custom-prop:; variants are now considered valid (see #50).

[5.1.0] — 2026–03–28

Added

• The no-multiple-whitespaces rule, which disallows multiple whitespaces between property values and function arguments.

Fixed

• The dependencies have now been updated to versions that include security fixes.

[5.0.1] — 2026–01–22

Fixed

... (truncated)

Commits

• d61d925 5.3.1
• 7f19ad7 List the fixes the patch carries in the changelog
• c04fb04 Stop at-rule-semicolon-newline-after reading past a comment on a line of it...
• b7ebbaf Pin the shapes of issue #74 the report enumerates
• 60e4f24 Raise only the lines inside a multiline pseudo-class in indentation
• f4dcd17 Measure and fix a multi-line declaration value in one copy in indentation
• 5645926 Scan values and params in raw coordinates in string-quotes
• 179bc06 Add the getAtRuleParams and setAtRuleParams utilities
• c34b947 Trim every line of a comment body in no-eol-whitespace (#97)
• 8e4d241 Stop selector-combinator-space-before from reporting a combinator behind a ...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​stylistic/stylelint-plugin since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.