Skip to content

Bump postcss-selector-parser, stylelint and stylelint-config-standard - #992

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-af2049d064
Open

Bump postcss-selector-parser, stylelint and stylelint-config-standard#992
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-af2049d064

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 6, 2026

Copy link
Copy Markdown
Contributor

Bumps postcss-selector-parser to 7.1.6 and updates ancestor dependencies postcss-selector-parser, stylelint and stylelint-config-standard. These dependencies need to be updated together.

Updates postcss-selector-parser from 6.1.4 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

  • fix: tolerate non-node children when serializing selectors

7.1.3

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

v7.1.1

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

  • feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

  • Feat: make insertions during iteration safe (major)
Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

7.1.0

  • feat: insert(Before|After) support multiple new node

7.0.0

  • Feat: make insertions during iteration safe (major)

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

6.1.1

  • Fixed: improve typings of constructor helpers (#292)

6.1.0

  • Feature: add sourceIndex to Selector nodes (#290)

6.0.16

... (truncated)

Commits
  • 4eb3468 7.1.6
  • 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
  • e33e9bc 7.1.5
  • 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
  • 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
  • e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
  • dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
  • 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
  • See full diff in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates stylelint from 14.16.1 to 17.16.0

Release notes

Sourced from stylelint's releases.

17.16.0

It fixes 2 bugs in the layout-mappings rules. This will likely be the last 17.x release, as we prepare for 18.0.0.

  • Fixed: property-layout-mappings and unit-layout-mappings false negatives for uppercase property names and units (#9485) (@​giaBaoJS).
  • Fixed: value-keyword-layout-mappings false positives for caption-side (#9483) (@​giaBaoJS).

17.15.0

It adds 1 new rule and 2 new rule options, and fixes 4 bugs.

  • Added: selector-no-unmatchable rule (#9451) (@​jeddy3).
  • Added: ignoreFunctions: [] to color-named and color-no-hex (#9463) (@​jsmitty12).
  • Fixed: custom-property-no-missing-var-function false positives for anchor positioning (#9466) (@​giaBaoJS).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix for font shorthand (#9402) (@​sarathfrancis90).
  • Fixed: declaration-property-max-values false positives for interpolated inline expressions (#9437) (@​alexchen-sys).
  • Fixed: selector-no-invalid false negatives for pseudo-elements, combinators and nested :has() (#9452) (@​jeddy3).

17.14.1

It fixes 4 bugs.

  • Fixed: quiet option suppresses report* warning reports (#9387) (@​ychampion).
  • Fixed: reported range of unknown rules (#9385) (@​ybiquitous).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#9364) (@​sarathfrancis90).
  • Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#9394) (@​sarathfrancis90).

17.14.0

It fixes 3 bugs, including a false negative one.

  • Fixed: performance of getting module paths (#9354) (@​jeddy3).
  • Fixed: performance by dynamically importing TIMING only on use (#9356) (@​jeddy3).
  • Fixed: function-calc-no-unspaced-operator false negatives for unspaced + and - operators following a * or / operator (#9357) (@​sarathfrancis90).

17.13.0

It fixes 3 bugs, including a false negative one.

  • Fixed: declaration-block-no-duplicate-properties false negatives for interleaved non-consecutive duplicates with ignore: ["consecutive-duplicates(-*)"] (#9324) (@​sarathfrancis90).
  • Fixed: selector-max-type false positives for nested selectors (#9319) (@​romainmenke).
  • Fixed: selector-type-no-unknown false positives for install (#9308) (@​Mouvedia).

17.12.0

It fixes 3 bugs, including a false negative one.

  • Fixed: block-no-empty reported range when using comments (#9294) (@​romainmenke).
  • Fixed: declaration-property-value-no-unknown false negatives for custom properties defined in reference files (#9292) (@​romainmenke).
  • Fixed: value-keyword-layout-mappings false positives for caption-side (#9293) (@​romainmenke).

17.11.1

It fixes 2 bugs.

  • Fixed: node_modules ignore for codeFilename paths containing a dot-prefixed directory (#9282) (@​tuhtah).
  • Fixed: declaration-block-no-redundant-longhand-properties range for contiguous redundant longhand properties (#9273) (@​pamelalozano16).

... (truncated)

Changelog

Sourced from stylelint's changelog.

17.16.0 - 2026-10-01

It fixes 2 bugs in the layout-mappings rules. This will likely be the last 17.x release, as we prepare for 18.0.0.

  • Fixed: property-layout-mappings and unit-layout-mappings false negatives for uppercase property names and units (#9485) (@​giaBaoJS).
  • Fixed: value-keyword-layout-mappings false positives for caption-side (#9483) (@​giaBaoJS).

17.15.0 - 2026-09-04

It adds 1 new rule and 2 new rule options, and fixes 4 bugs.

  • Added: selector-no-unmatchable rule (#9451) (@​jeddy3).
  • Added: ignoreFunctions: [] to color-named and color-no-hex (#9463) (@​jsmitty12).
  • Fixed: custom-property-no-missing-var-function false positives for anchor positioning (#9466) (@​giaBaoJS).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix for font shorthand (#9402) (@​sarathfrancis90).
  • Fixed: declaration-property-max-values false positives for interpolated inline expressions (#9437) (@​alexchen-sys).
  • Fixed: selector-no-invalid false negatives for pseudo-elements, combinators and nested :has() (#9452) (@​jeddy3).

17.14.1 - 2026-07-20

It fixes 4 bugs.

  • Fixed: quiet option suppresses report* warning reports (#9387) (@​ychampion).
  • Fixed: reported range of unknown rules (#9385) (@​ybiquitous).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#9364) (@​sarathfrancis90).
  • Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#9394) (@​sarathfrancis90).

17.14.0 - 2026-06-25

It fixes 3 bugs, including a false negative one.

  • Fixed: performance of getting module paths (#9354) (@​jeddy3).
  • Fixed: performance by dynamically importing TIMING only on use (#9356) (@​jeddy3).
  • Fixed: function-calc-no-unspaced-operator false negatives for unspaced + and - operators following a * or / operator (#9357) (@​sarathfrancis90).

17.13.0 - 2026-06-06

It fixes 3 bugs, including a false negative one.

  • Fixed: declaration-block-no-duplicate-properties false negatives for interleaved non-consecutive duplicates with ignore: ["consecutive-duplicates(-*)"] (#9324) (@​sarathfrancis90).
  • Fixed: selector-max-type false positives for nested selectors (#9319) (@​romainmenke).
  • Fixed: selector-type-no-unknown false positives for install (#9308) (@​Mouvedia).

17.12.0 - 2026-05-20

It fixes 3 bugs, including a false negative one.

  • Fixed: block-no-empty reported range when using comments (#9294) (@​romainmenke).
  • Fixed: declaration-property-value-no-unknown false negatives for custom properties defined in reference files (#9292) (@​romainmenke).
  • Fixed: value-keyword-layout-mappings false positives for caption-side (#9293) (@​romainmenke).

... (truncated)

Commits
  • bc06c7c Release 17.16.0 (#9551)
  • f4fb76f Set target-branch to v18 in Dependabot config (#9488)
  • 2019478 Fix property-layout-mappings and unit-layout-mappings false negatives for...
  • e875710 Fix value-keyword-layout-mappings false positives for caption-side (#9483)
  • 0547bff Release 17.15.0 (#9484)
  • ac19a3c Fix custom-property-no-missing-var-function false positives for anchor posi...
  • 23947ae Bump @​humanfs/node from 0.16.6 to 0.16.8 (#9480)
  • 53c74f7 Bump fast-uri from 3.1.5 to 3.1.7 (#9481)
  • 26856e6 Bump the jest group across 1 directory with 2 updates (#9476)
  • b90ecd8 Bump browserslist from 4.28.4 to 4.28.8 (#9479)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for stylelint since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates stylelint-config-standard from 29.0.0 to 40.0.0

Release notes

Sourced from stylelint-config-standard's releases.

40.0.0

  • Removed: stylelint less than 17.0.0 from peer dependencies.
  • Removed: support for Node.js less than 20.19.0.
  • Changed: updated to stylelint-config-recommended@18.0.0.
  • Changed: module type to ESM.

39.0.1

  • Fixed: layer-name-pattern false positives for dot notation.

39.0.0

38.0.0

  • Removed: stylelint less than 16.18.0 from peer dependencies.
  • Changed: updated to stylelint-config-recommended@16.0.0.
  • Added: color-function-alias-notation: "without-alpha" rule.
  • Added: container-name-pattern (kebab-case with optional -- prefix) rule.
  • Added: layer-name-pattern (kebab-case) rule.

37.0.0

36.0.1

  • Fixed: missing funding field in package.json.

36.0.0

  • Removed: stylelint less than 16.1.0 from peer dependencies.
  • Added: lightness-notation: "percentage" rule.

35.0.0

34.0.0

33.0.0

  • Removed: stylelint less than 15.5.0 from peer dependencies.
  • Changed: updated to stylelint-config-recommended@12.0.0.
  • Changed: restored declaration-block-single-line-max-declarations removed on 30.0.0.

32.0.0

  • Removed: stylelint less than 15.4.0 from peer dependencies.
  • Added: media-feature-range-notation: "context" rule

... (truncated)

Changelog

Sourced from stylelint-config-standard's changelog.

40.0.0

  • Removed: stylelint less than 17.0.0 from peer dependencies.
  • Removed: support for Node.js less than 20.19.0.
  • Changed: updated to stylelint-config-recommended@18.0.0.
  • Changed: module type to ESM.

39.0.1

  • Fixed: layer-name-pattern false positives for dot notation.

39.0.0

38.0.0

  • Removed: stylelint less than 16.18.0 from peer dependencies.
  • Changed: updated to stylelint-config-recommended@16.0.0.
  • Added: color-function-alias-notation: "without-alpha" rule.
  • Added: container-name-pattern (kebab-case with optional -- prefix) rule.
  • Added: layer-name-pattern (kebab-case) rule.

37.0.0

36.0.1

  • Fixed: missing funding field in package.json.

36.0.0

  • Removed: stylelint less than 16.1.0 from peer dependencies.
  • Added: lightness-notation: "percentage" rule.

35.0.0

34.0.0

... (truncated)

Commits
  • fbbe7b8 Release 40.0.0 (#386)
  • e6368f9 Prepare 40.0.0 (#381)
  • 481e21c Bump the dev-deps group with 3 updates (#382)
  • 696689d Bump stylelint/.github/.github/workflows/call-release-pr.yml from 0.3.1 to 0....
  • 5d46c0f Bump stylelint/.github/.github/workflows/call-lint.yml from 0.3.1 to 0.5.0 (#...
  • f888c90 Bump stylelint/.github/.github/workflows/call-test.yml from 0.3.1 to 0.5.0 (#...
  • 066dda1 Fix vulnerable dependencies via npm audit fix (#378)
  • b6e6aec Bump js-yaml from 4.1.0 to 4.1.1 (#379)
  • 63bb8dd Bump mdast-util-to-hast from 13.1.0 to 13.2.1 (#380)
  • 0cc790a Bump the dev-deps group with 2 updates (#377)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for stylelint-config-standard since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump postcss-selector-parser, stylelint and stylelint-config-standard
b18790f 
Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) to 7.1.6 and updates ancestor dependencies [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser), [stylelint](https://github.com/stylelint/stylelint) and [stylelint-config-standard](https://github.com/stylelint/stylelint-config-standard). These dependencies need to be updated together.


Updates `postcss-selector-parser` from 6.1.4 to 7.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@6.1.4...7.1.6)

Updates `stylelint` from 14.16.1 to 17.16.0
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](stylelint/stylelint@14.16.1...17.16.0)

Updates `stylelint-config-standard` from 29.0.0 to 40.0.0
- [Release notes](https://github.com/stylelint/stylelint-config-standard/releases)
- [Changelog](https://github.com/stylelint/stylelint-config-standard/blob/main/CHANGELOG.md)
- [Commits](stylelint/stylelint-config-standard@29.0.0...40.0.0)

---
updated-dependencies:
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
- dependency-name: stylelint
  dependency-version: 17.16.0
  dependency-type: direct:development
- dependency-name: stylelint-config-standard
  dependency-version: 40.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 6, 2026
@sonarqubecloud

sonarqubecloud Bot commented Oct 6, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@erwindon erwindon self-assigned this Oct 6, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@erwindon erwindon

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@erwindon