chore(deps)(deps-dev): bump postcss-selector-parser from 7.1.1 to 7.1.5 - #239
chore(deps)(deps-dev): bump postcss-selector-parser from 7.1.1 to 7.1.5#239dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) from 7.1.1 to 7.1.5. - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.5) --- updated-dependencies: - dependency-name: postcss-selector-parser dependency-version: 7.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security review — PR #239
Verdict: No high-confidence vulnerabilities introduced. This change is a security-positive lockfile bump.
Scope reviewed
- Files changed:
package-lock.jsononly - Change:
postcss-selector-parser7.1.1→7.1.5(transitive dev dependency ofeslint-plugin-astro) - Application/runtime code: none
Checklist results
| Area | Finding |
|---|---|
| Injection (SQL/command/template/path) | No new code paths; no change to input handling |
| Authn/authz | Not applicable |
| Secrets / logging | Not applicable |
| Deserialization / SSRF / XSS / CSRF | Not applicable |
| Supply chain | Patch-level upgrade within the same package; integrity hash added in lockfile |
Supply-chain note (informational, not a blocker)
The prior pinned version (7.1.1) was affected by CVE-2026-9358 (uncontrolled recursion / DoS when parsing deeply nested CSS selectors). Versions ≥7.1.2 include a nesting-depth cap. 7.1.5 is not flagged by npm audit or Snyk and includes that fix.
Exposure context: postcss-selector-parser is dev: true and only used during ESLint analysis of Astro/CSS selectors in CI/local lint — it is not shipped to production (npm run audit:ci also omits dev deps). Even on the old version, practical production risk was negligible; this bump still closes the advisory in the dev toolchain.
Confirmed vulnerabilities
None introduced by this PR.
Uncertain concerns
None requiring validation.
Automated security review — no code changes recommended.
Sent by Cursor Automation: Find vulnerabilities
Bumps postcss-selector-parser from 7.1.1 to 7.1.5.
Release notes
Sourced from postcss-selector-parser's releases.
Changelog
Sourced from postcss-selector-parser's changelog.
Commits
e33e9bc7.1.56f4e6c1fix: TypeError on unclosed[,(and trailing|(#330)4d8437ffix: preserve whitespace before a*namespace in attribute selectors (#325)e2f9029fix: don't treat a non-prefix token before|as a namespace (#324)dd50ee1chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)7e3abb2chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)4a7e4e37.1.4e2021c5fix: tolerate non-node children when serializing selectors7893b747.1.35bc698cImprove fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clo...Maintainer changes
This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.