[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
postcss-selector-parser	^6.0.6 → ^7.1.7

Test plan: CI should pass with updated dependencies. No review required: this is an automated dependency update PR.

---

Release Notes

postcss/postcss-selector-parser (postcss-selector-parser)

v7.1.7

Compare Source

• fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#​337 by @​theRizwan)
• fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#​340 by @​jakezwang)
• fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#​343 by @​feritcemkahraman)
• fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#​342 by @​SAY-5)
• fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#​339 by @​dkryaklin)

v7.1.6

Compare Source

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

v7.1.5

Compare Source

• fix: don't treat a non-prefix token before | as a namespace (#​324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#​325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#​330 by @​theRizwan)

v7.1.4

Compare Source

• fix: tolerate non-node children when serializing selectors

v7.1.3

Compare Source

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

v7.1.2

Compare Source

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#​316 by @​MoOx)

v7.1.1

Compare Source

• perf: replace startsWith with strict equality (#​308)
• fix(types): add walkUniversal declaration (#​311)

v7.1.0

Compare Source

• feat: insert(Before|After) support multiple new node

v7.0.0

Compare Source

• Feat: make insertions during iteration safe (major)

v6.1.5

Compare Source

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#​346 by @​bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x
version, and until now the only remediation on offer was an upgrade to 7.x.
6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind
CSS 3 in particular, which depends on ^6.1.2. From here on it receives security
fixes only: no features, no other bug fixes, no type changes. Everything else
goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer
depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so
npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6
ranges pick up 6.1.5 as usual.

v6.1.4

Compare Source

• fix: tolerate non-node children when serializing selectors

v6.1.3

Compare Source

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 via backport of (#​316 by @​MoOx)

v6.1.2

Compare Source

• Fixed: erroneous trailing combinators in pseudos

v6.1.1

Compare Source

• Fixed: improve typings of constructor helpers (#​292)

v6.1.0

Compare Source

• Feature: add sourceIndex to Selector nodes (#​290)

v6.0.16

Compare Source

• Fixed: add missing index argument to each/walk callback types (#​289)

v6.0.15

Compare Source

• Fixed: Node#prev and Node#next type for the first/last node

v6.0.14

Compare Source

• Fixed: type definitions

v6.0.13

Compare Source

• Fixed: throw on unexpected pipe symbols

v6.0.12

Compare Source

• Fixed: clone arguments should be optional

v6.0.11

Compare Source

• Fixed: parse attribute case insensitivity flag

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.