[Snyk] Upgrade postcss from 8.1.0 to 8.3.5 #2

snyk-bot · 2021-07-12T01:26:42Z

Snyk has created this PR to upgrade postcss from 8.1.0 to 8.3.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 36 versions ahead of your current version.
The recommended version was released 25 days ago, on 2021-06-17.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	479/1000 Why? Has a fix available, CVSS 5.3	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1090595	479/1000 Why? Has a fix available, CVSS 5.3	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: postcss

8.3.5 - 2021-06-17
- Fixed broken AST detection.
8.3.4 - 2021-06-14
- Fixed broken AST detection.
8.3.3 - 2021-06-14
- Fixed broken AST on postcss dependency duplication in custom parsers.
8.3.2 - 2021-06-11
- Update changelog.
8.3.1 - 2021-06-09
- Fixed false positives PostCSS does nothing warning on syntax option.
8.3.0 - 2021-05-21

PostCSS 8.3 improved source map parsing performance, added Node#assign() shortcut, and experimental Document node to AST.

Thanks to Sponsors

This release was possible thanks to our community.

If your company wants to support the sustainability of front-end infrastructure or wants to give some love to PostCSS, you can join our supporters by:
- Tidelift with a Spotify-like subscription model supporting all projects from your lock file.
- Direct donations in PostCSS & Autoprefixer Open Collective.
Source Map Performance

Because PostCSS needs synchronous API, we can’t move from the old `source-map 0.6 to 0.7 (many other open-source projects too).

@ 7rulnik forked source-map 0.6 to source-map-js and back-ported performance improvements from 0.7. In 8.3 we switched from source-map to this source-map-js fork.

You map see 4x performance improvements in parsing map from processing step before PostCSS (for instance, Sass).

Document Nodes

Thanks to @ gucong3000, PostCSS already parse CSS from HTML and JS files (CSS-in-JS templates and objects).

But his plugin need big updates. @ hudochenkov from stylelint team decided to create new parsers for styles inside CSS-in-JS, HTML, and Markdown.

He suggested adding new Document node type to PostCSS AST to keep multiple Root nodes inside and JS/HTML/Markdown code blocks between these style blocks.
```
const document = htmlParser(
  '<html><style>a{color:black}</style><style>b{z-index:2}</style>'
)
document.type          //=> 'document'
document.nodes.length  //=> 2
document.nodes[0].type //=> 'root'
```
This is an experimental feature. Some aspects of this node could change within minor or patch version releases.

Node#assign() Shortcut

The creator of famous postcss-preset-env and many other PostCSS tools, @ jonathantneal suggested a nice shortcut to change multiple properties in the node:
```
decl.assign({ prop: 'word-wrap', value: 'break-word' })
```
8.2.15 - 2021-05-10
- Fixed list type definitions (by @ n19htz).
8.2.14 - 2021-05-05
- Removed source-map from client-side bundle (by @ barak007).
8.2.13 - 2021-04-26
- Fixed ReDoS vulnerabilities in source map parsing (by @ yetingli).
8.2.12 - 2021-04-22
8.2.11 - 2021-04-22
8.2.10 - 2021-04-11
8.2.9 - 2021-03-30
8.2.8 - 2021-03-09
8.2.7 - 2021-03-03
8.2.6 - 2021-02-10
8.2.5 - 2021-02-06
8.2.4 - 2021-01-09
8.2.3 - 2021-01-07
8.2.2 - 2020-12-29
8.2.1 - 2020-12-09
8.2.0 - 2020-12-08
8.1.14 - 2020-12-04
8.1.13 - 2020-12-03
8.1.12 - 2020-12-03
8.1.11 - 2020-12-03
8.1.10 - 2020-11-23
8.1.9 - 2020-11-21
8.1.8 - 2020-11-19
8.1.7 - 2020-11-10
8.1.6 - 2020-11-05
8.1.5 - 2020-11-05
8.1.4 - 2020-10-24
8.1.3 - 2020-10-23
8.1.2 - 2020-10-19
8.1.1 - 2020-09-28
8.1.0 - 2020-09-26