Skip to content

Bump postcss-selector-parser, postcss-modules-local-by-default, postcss-modules-scope and eslint-plugin-vue - #393

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-3318cd865d
Open

Bump postcss-selector-parser, postcss-modules-local-by-default, postcss-modules-scope and eslint-plugin-vue#393
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-3318cd865d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps postcss-selector-parser to 7.1.6 and updates ancestor dependencies postcss-selector-parser, postcss-modules-local-by-default, postcss-modules-scope and eslint-plugin-vue. These dependencies need to be updated together.

Updates postcss-selector-parser from 6.1.4 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

  • fix: tolerate non-node children when serializing selectors

7.1.3

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

v7.1.1

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

  • feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

  • Feat: make insertions during iteration safe (major)
Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

7.1.0

  • feat: insert(Before|After) support multiple new node

7.0.0

  • Feat: make insertions during iteration safe (major)

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

6.1.1

  • Fixed: improve typings of constructor helpers (#292)

6.1.0

  • Feature: add sourceIndex to Selector nodes (#290)

6.0.16

... (truncated)

Commits
  • 4eb3468 7.1.6
  • 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
  • e33e9bc 7.1.5
  • 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
  • 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
  • e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
  • dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
  • 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
  • See full diff in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates postcss-modules-local-by-default from 4.0.3 to 4.2.0

Release notes

Sourced from postcss-modules-local-by-default's releases.

v4.2.0

4.2.0 - 2024-12-11

  • feat: add support a /* cssmodules-pure-no-check */ comment

v4.1.0

4.1.0 - 2024-11-11

  • feat: add global() and local() for animations
  • feat: add pure ignore comment
  • fix: css nesting and pure mode

v4.0.5

4.0.5 - 2024-04-03

Fixes

  • don't break the @scope at-rule without params

v4.0.4

4.0.4 - 2024-01-17

Fixes

  • handle @scope at-rule
  • css nesting
  • do not tread negative values as identifiers in the animation shorthand
Changelog

Sourced from postcss-modules-local-by-default's changelog.

4.2.0 - 2024-12-11

  • feat: add support a /* cssmodules-pure-no-check */ comment

4.1.0 - 2024-11-11

  • feat: add global() and local() for animations
  • feat: add pure ignore comment
  • fix: css nesting and pure mode

4.0.5 - 2024-04-03

Fixes

  • don't break the @scope at-rule without params

4.0.4 - 2024-01-17

Fixes

  • handle @scope at-rule
  • css nesting
  • do not tread negative values as identifiers in the animation shorthand
Commits
  • db195e7 chore(release): 4.2.0
  • ba7e8ef feat: added support a cssmodules-pure-no-check comment
  • 39a2f78 docs: fix (#83)
  • e489ff8 chore(release): 4.1.0
  • 3811927 fix: css nesting and pure mode
  • 582bd9e chore: postcss-selector-parser (#81)
  • 9d07eeb feat: add pure ignore comment for CSS Modules (#80)
  • fde62d7 feat: add global and local for animations (#76)
  • a73b700 test: for current pure logic (#74)
  • f1c05a5 test: enhanced test cases to prepare for CSS declaration-level processing (#77)
  • Additional commits viewable in compare view

Updates postcss-modules-scope from 3.0.0 to 3.2.1

Release notes

Sourced from postcss-modules-scope's releases.

v3.2.1

3.2.1

Chore

  • update postcss-selector-parser

v3.2.0

3.2.0 - 2024-04-03

Features

  • supports multiple composes, i.e. .class { composes: a b, global(c), d e from "./path/file.css" }

v3.1.2

3.1.2 - 2024-04-03

Fixes

  • export a root and limit from the @scope at-rule

v3.1.1

3.1.1 - 2024-01-18

Fixes

  • handle @scope at-rule
  • fix CSS nesting logic

v3.1.0

3.1.0 - 2023-12-21

Fixes

  • scoped class attribute

Feature

  • pass a node to the generateExportEntry option
Changelog

Sourced from postcss-modules-scope's changelog.

3.2.1

Chore

  • update postcss-selector-parser

3.2.0 - 2024-04-03

Features

  • supports multiple composes, i.e. .class { composes: a b, global(c), d e from "./path/file.css" }

3.1.2 - 2024-04-03

Fixes

  • export a root and limit from the @scope at-rule

3.1.1 - 2024-01-18

Fixes

  • handle @scope at-rule
  • fix CSS nesting logic

3.1.0 - 2023-12-21

Fixes

  • scoped class attribute

Features

  • pass a node to the generateExportEntry option
Commits

Updates eslint-plugin-vue from 9.33.0 to 10.11.1

Release notes

Sourced from eslint-plugin-vue's releases.

v10.11.1

Patch Changes

v10.11.0

Minor Changes

Patch Changes

  • Fixed vue/use-v-on-exact to avoid reporting @keydown.stop when paired with an exact key-specific listener (#3082)
  • Specified explicit items policies for array rule option schemas (#3112)
  • Updated resources (HTML elements) (#3132 and #3133)

v10.10.0

Minor Changes

Patch Changes

  • Updated @eslint-community/eslint-utils, semver and xml-name-validator dependencies (#3094)

v10.9.2

Patch Changes

v10.9.1

Patch Changes

v10.9.0

Minor Changes

... (truncated)

Changelog

Sourced from eslint-plugin-vue's changelog.

10.11.1

Patch Changes

10.11.0

Minor Changes

Patch Changes

  • Fixed vue/use-v-on-exact to avoid reporting @keydown.stop when paired with an exact key-specific listener (#3082)
  • Specified explicit items policies for array rule option schemas (#3112)
  • Updated resources (HTML elements) (#3132 and #3133)

10.10.0

Minor Changes

Patch Changes

  • Updated @eslint-community/eslint-utils, semver and xml-name-validator dependencies (#3094)

10.9.2

Patch Changes

10.9.1

Patch Changes

10.9.0

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-plugin-vue since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump postcss-selector-parser, postcss-modules-local-by-default, postc…
93f7406 
…ss-modules-scope and eslint-plugin-vue

Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) to 7.1.6 and updates ancestor dependencies [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser), [postcss-modules-local-by-default](https://github.com/css-modules/postcss-modules-local-by-default), [postcss-modules-scope](https://github.com/css-modules/postcss-modules-scope) and [eslint-plugin-vue](https://github.com/vuejs/eslint-plugin-vue). These dependencies need to be updated together.


Updates `postcss-selector-parser` from 6.1.4 to 7.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@6.1.4...7.1.6)

Updates `postcss-modules-local-by-default` from 4.0.3 to 4.2.0
- [Release notes](https://github.com/css-modules/postcss-modules-local-by-default/releases)
- [Changelog](https://github.com/css-modules/postcss-modules-local-by-default/blob/master/CHANGELOG.md)
- [Commits](css-modules/postcss-modules-local-by-default@v4.0.3...v4.2.0)

Updates `postcss-modules-scope` from 3.0.0 to 3.2.1
- [Release notes](https://github.com/css-modules/postcss-modules-scope/releases)
- [Changelog](https://github.com/css-modules/postcss-modules-scope/blob/master/CHANGELOG.md)
- [Commits](css-modules/postcss-modules-scope@v3.0.0...v3.2.1)

Updates `eslint-plugin-vue` from 9.33.0 to 10.11.1
- [Release notes](https://github.com/vuejs/eslint-plugin-vue/releases)
- [Changelog](https://github.com/vuejs/eslint-plugin-vue/blob/master/CHANGELOG.md)
- [Commits](vuejs/eslint-plugin-vue@v9.33.0...v10.11.1)

---
updated-dependencies:
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
- dependency-name: postcss-modules-local-by-default
  dependency-version: 4.2.0
  dependency-type: indirect
- dependency-name: postcss-modules-scope
  dependency-version: 3.2.1
  dependency-type: indirect
- dependency-name: eslint-plugin-vue
  dependency-version: 10.11.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 12, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants