[dependabot]

Bumps postcss-selector-parser from 7.1.4 to 7.2.0.

Release notes

Sourced from postcss-selector-parser's releases.

7.2.0

• feat: add the opt-in maxInputLength option, which rejects a selector longer than the limit before parsing it
• feat: support the case-sensitive attribute flag s per Selectors Level 4, on Attribute#sensitive and Attribute#sensitiveFlag. [a=b s] previously left insensitive: false and filed the flag in raws.insensitiveFlag (#327 by @​abhu85)
• docs: add a threat model to SECURITY.md: resource consumption caused by unbounded untrusted input is now handled as a regular bug
• docs: document the raw-value helpers (stringifyProperty, valueToString, setPropertyAndEscape, appendToPropertyAndEscape, setPropertyWithoutEscape), the seventeen type guards, and the clone() overrides argument (#231)
• fix: forward the default options given to the parser factory, so parser(fn, { maxInputLength }) and the other options take effect there as documented (#345 by @​Aurantium-47)
• fix: preserve the spaces declared on selector and root containers, through rawSpaceBefore and rawSpaceAfter (#356 by @​Aschenbath)
• fix: preserve selector delimiters after an escaped backslash, so .a\\.b parses as two classes (#354 by @​wozhenbang2004)
• fix: escape class values supplied to the constructor, matching what the value setter already did (#349 by @​SAY-5)
• fix: escape values assigned to an id through the value setter, and replace a stale raws.value on assignment (#326 by @​mahirhir)
• fix: keep $ in an attribute name inside a preprocessor interpolation, so [#{$attr}] in SCSS and [@{attr}] in Less round-trip (#336 by @​theRizwan)
• fix: reject an attribute selector with no valid attribute name, instead of throwing a raw TypeError or emitting the literal text undefined (#335 by @​theRizwan)
• fix: keep the processor's entry points usable when destructured, as in const { process } = parser() (#145)

Behaviour notes

• className and id values are escaped when passed to a constructor or assigned through value, so an already-escaped value is now escaped twice. setPropertyWithoutEscape() is the escape hatch.
• [a=b s] sets sensitive: true rather than filing the flag in raws.insensitiveFlag. Serialization is byte-identical for i, I, s, S and non-standard flags.
• Selector and Root emit their own rawSpaceBefore and rawSpaceAfter, which changes serialization for ASTs that set them.
• An attribute selector with no attribute name raises the parser's own error rather than throwing a raw TypeError or serializing the text undefined: [ns|*] and [ * ] are affected. A trailing *, $, ^, ~ or | after a valid name is dropped, as [href=] already was.

7.1.8

• fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (reported by @​zachariah-mithani)
• chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear

7.1.7

• fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @​theRizwan)
• fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @​jakezwang)
• fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @​feritcemkahraman)
• fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @​SAY-5)
• fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @​dkryaklin)

7.1.6

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

Changelog

Sourced from postcss-selector-parser's changelog.

7.2.0 - 2026-11-08

• feat: add the opt-in maxInputLength option, which rejects a selector longer than the limit before parsing it
• feat: support the case-sensitive attribute flag s per Selectors Level 4, on Attribute#sensitive and Attribute#sensitiveFlag. [a=b s] previously left insensitive: false and filed the flag in raws.insensitiveFlag (#327 by @​abhu85)
• docs: add a threat model to SECURITY.md: resource consumption caused by unbounded untrusted input is now handled as a regular bug
• docs: document the raw-value helpers (stringifyProperty, valueToString, setPropertyAndEscape, appendToPropertyAndEscape, setPropertyWithoutEscape), the seventeen type guards, and the clone() overrides argument (#231)
• fix: forward the default options given to the parser factory, so parser(fn, { maxInputLength }) and the other options take effect there as documented (#345 by @​Aurantium-47)
• fix: preserve the spaces declared on selector and root containers, through rawSpaceBefore and rawSpaceAfter (#356 by @​Aschenbath)
• fix: preserve selector delimiters after an escaped backslash, so .a\\.b parses as two classes (#354 by @​wozhenbang2004)
• fix: escape class values supplied to the constructor, matching what the value setter already did (#349 by @​SAY-5)
• fix: escape values assigned to an id through the value setter, and replace a stale raws.value on assignment (#326 by @​mahirhir)
• fix: keep $ in an attribute name inside a preprocessor interpolation, so [#{$attr}] in SCSS and [@{attr}] in Less round-trip (#336 by @​theRizwan)
• fix: reject an attribute selector with no valid attribute name, instead of throwing a raw TypeError or emitting the literal text undefined (#335 by @​theRizwan)
• fix: keep the processor's entry points usable when destructured, as in const { process } = parser() (#145)

Behaviour notes

• className and id values are escaped when passed to a constructor or assigned through value, so an already-escaped value is now escaped twice. setPropertyWithoutEscape() is the escape hatch.
• [a=b s] sets sensitive: true rather than filing the flag in raws.insensitiveFlag. Serialization is byte-identical for i, I, s, S and non-standard flags.
• Selector and Root emit their own rawSpaceBefore and rawSpaceAfter, which changes serialization for ASTs that set them.
• An attribute selector with no attribute name raises the parser's own error rather than throwing a raw TypeError or serializing the text undefined: [ns|*] and [ * ] are affected. A trailing *, $, ^, ~ or | after a valid name is dropped, as [href=] already was.

7.1.8 - 2026-11-08

• fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (GHSA-67xj-gfww-g738, reported by @​zachariah-mithani)
• chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear

7.1.7 - 2026-10-19

• fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @​theRizwan)
• fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @​jakezwang)
• fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @​feritcemkahraman)
• fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @​SAY-5)
• fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @​dkryaklin)

7.1.6 - 2026-09-03

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

Commits

• 7591d8d 7.2.0
• 04925df docs: document the raw-value helpers, the type guards and clone overrides
• 0d9397f feat: add maxInputLength option and document the threat model
• a9fff88 fix: reject attribute selectors with no valid attribute name (#335)
• 617c25b fix: keep $ in an attribute name inside a preprocessor interpolation (#336)
• 815dc18 fix: preserve selector delimiters after escaped backslashes (#354)
• 767b5e1 fix: keep the processor's entry points usable when destructured
• e7be6bf feat: support the case-sensitive attribute flag (s) per Selectors Level 4 (#327)
• 0ca18af fix: escape values assigned to an id through the value setter (#326)
• b74fdd4 fix: escape class values supplied to the constructor (#349)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.