Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: postcss/postcss-selector-parser
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: postcss/postcss-selector-parser
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 6.x.x
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 6 commits
  • 16 files changed
  • 1 contributor

Commits on Jun 11, 2026

  1. Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316) 

    * Add failing tests for #315

* Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882

* Improve recursion testing following @copilot review

* Improve recursion implementation following @copilot review

* Improve recursion implementation (resolveMaxNestingDepth) following @copilot review

* Last improvements on recursion issue implementation

* Add a note in README about CVE-2026-9358 limitation
    @MoOx
    MoOx committed Jun 11, 2026
    Configuration menu
    Copy the full SHA
    053e949 View commit details
    Browse the repository at this point in the history

  2. Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873… 

    …882 (clone/walk)
    @MoOx
    MoOx committed Jun 11, 2026
    Configuration menu
    Copy the full SHA
    b6330e5 View commit details
    Browse the repository at this point in the history

  3. npm audit fix + update CI

    @MoOx
    MoOx committed Jun 11, 2026
    Configuration menu
    Copy the full SHA
    bd927e2 View commit details
    Browse the repository at this point in the history

  4. 6.1.3

    @MoOx
    MoOx committed Jun 11, 2026
    Configuration menu
    Copy the full SHA
    08ac3e5 View commit details
    Browse the repository at this point in the history

  5. fix: tolerate non-node children when serializing selectors 

    The CVE-2026-9358 fix rewrote Container#toString to recurse through a private
_stringify method, which assumes every child implements it. But passing an
array to replaceWith() / insertBefore() / insertAfter() stores a raw Array
(not a Node) in `nodes`: the previous `this.map(String)` coerced it leniently,
whereas the new code threw `TypeError: child._stringify is not a function`.

This silently broke Tailwind CSS v3, which uses `pseudo.replaceWith(pseudo.nodes)`
to expand :merge() — the mechanism behind every group-* / peer-* variant —
producing zero CSS for those variants.

Serialization now falls back to String(child) for non-node children, restoring
the pre-fix behaviour while keeping the nesting-depth guard intact.
    @MoOx
    MoOx committed Jun 11, 2026
    Configuration menu
    Copy the full SHA
    99d9299 View commit details
    Browse the repository at this point in the history

  6. 6.1.4

    @MoOx
    MoOx committed Jun 11, 2026
    Configuration menu
    Copy the full SHA
    fb22e12 View commit details
    Browse the repository at this point in the history
Loading