Skip to content

Bump postcss-selector-parser and @vue/cli-service in /ui - #14503

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ui/multi-93846ae568
Open

Bump postcss-selector-parser and @vue/cli-service in /ui#14503
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ui/multi-93846ae568

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps postcss-selector-parser to 6.1.6 and updates ancestor dependency @vue/cli-service. These dependencies need to be updated together.

Updates postcss-selector-parser from 3.1.2 to 6.1.6

Release notes

Sourced from postcss-selector-parser's releases.

6.1.6

  • fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (reported by @​zachariah-mithani)
  • chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear

6.1.5

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

6.1.4

  • fix: tolerate non-node children when serializing selectors

6.1.3

v6.1.2

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

v6.1.1

6.1.1

  • Fixed: improve typings of constructor helpers (#292)

v6.1.0

6.1.0

  • Feature: add sourceIndex to Selector nodes (#290)

v6.0.16

6.0.16

  • Fixed: add missing index argument to each/walk callback types (#289)

v6.0.15

... (truncated)

Changelog

Sourced from postcss-selector-parser's changelog.

6.1.6 - 2026-11-08

  • fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (reported by @​zachariah-mithani)
  • chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear

6.1.5 - 2026-10-19

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

6.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

6.1.3 - 2026-06-11

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

6.1.1

  • Fixed: improve typings of constructor helpers (#292)

6.1.0

  • Feature: add sourceIndex to Selector nodes (#290)

6.0.16

  • Fixed: add missing index argument to each/walk callback types (#289)

6.0.15

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates @vue/cli-service from 4.5.19 to 5.0.9

Release notes

Sourced from @​vue/cli-service's releases.

v5.0.9

🐛 Bug Fix

  • @vue/cli-service
    • #7443 fix: add missing default __VUE_PROD_HYDRATION_MISMATCH_DETAILS__, fixes compatibility with vue 3.5.19 (@​bobvandevijver)

v5.0.8

🐛 Bug Fix

v5.0.7

  • @vue/cli-service
  • @vue/cli-ui
    • #7210 chore: upgrade to apollo-server-express 3.x

Committers: 2

v5.0.6

Fix compatibility with the upcoming Vue 2.7 (currently in alpha) and Vue Loader 15.10 (currently in beta).

In Vue 2.7, vue-template-compiler is no longer a required peer dependency. Rather, there's a new export under the main package as vue/compiler-sfc.

v5.0.5

🐛 Bug Fix

  • @vue/cli
    • #7167 fix(upgrade): prevent changing the structure of package.json file during upgrade (@​blzsaa)
  • @vue/cli-service
  • @vue/cli-plugin-e2e-cypress
    • [697bb44] fix: should correctly resolve cypress bin path for Cypress 10 (Note that the project is still created with Cypress 9 by default, but you can upgrade to Cypress 10 on your own now)

Committers: 3

v5.0.4

🐛 Bug Fix

  • @vue/cli-service
  • @vue/cli-shared-utils, @vue/cli-ui
    • 75826d6 fix: replace node-ipc with @achrinza/node-ipc to further secure the dependency chain

... (truncated)

Changelog

Sourced from @​vue/cli-service's changelog.

5.0.9 (2025-08-21)

🐛 Bug Fix

Committers: 2

5.0.7 (2022-07-05)

  • @vue/cli-service
  • @vue/cli-ui
    • #7210 chore: upgrade to apollo-server-express 3.x

Committers: 2

5.0.6 (2022-06-16)

Fix compatibility with the upcoming Vue 2.7 (currently in alpha) and Vue Loader 15.10 (currently in beta).

In Vue 2.7, vue-template-compiler is no longer a required peer dependency. Rather, there's a new export under the main package as vue/compiler-sfc.

5.0.5 (2022-06-16)

🐛 Bug Fix

  • @vue/cli
    • #7167 feat(upgrade): prevent changing the structure of package.json file during upgrade (@​blzsaa)
  • @vue/cli-service

Committers: 3

... (truncated)

Commits
  • 7eb93c1 v5.0.9
  • c21c156 fix: add missing default __VUE_PROD_HYDRATION_MISMATCH_DETAILS__ (#7443)
  • b154dbd v5.0.8
  • 0260e4d fix: add devServer.server.type to useHttps judgement (#7222)
  • 4a0655f v5.0.7
  • beffe8a fix: allow disabling progress plugin via devServer.client.progress
  • 558dea2 fix: support devServer.server option, avoid deprecation warning
  • bddd64d fix: optimize the judgment on whether HTTPS has been set in options (#7202)
  • ef08a08 v5.0.6
  • fcf27e3 fixup! fix: compatibility with Vue 2.7
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 27, 2026
@github-actions

github-actions Bot commented Nov 10, 2026

Copy link
Copy Markdown

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

@dependabot
Bump postcss-selector-parser and @vue/cli-service in /ui
c81863f 
Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) to 6.1.6 and updates ancestor dependency [@vue/cli-service](https://github.com/vuejs/vue-cli/tree/HEAD/packages/@vue/cli-service). These dependencies need to be updated together.


Updates `postcss-selector-parser` from 3.1.2 to 6.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/6.1.6/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v3.1.2...6.1.6)

Updates `@vue/cli-service` from 4.5.19 to 5.0.9
- [Release notes](https://github.com/vuejs/vue-cli/releases)
- [Changelog](https://github.com/vuejs/vue-cli/blob/dev/CHANGELOG.md)
- [Commits](https://github.com/vuejs/vue-cli/commits/v5.0.9/packages/@vue/cli-service)

---
updated-dependencies:
- dependency-name: "@vue/cli-service"
  dependency-version: 5.0.9
  dependency-type: direct:development
- dependency-name: postcss-selector-parser
  dependency-version: 6.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump postcss-selector-parser and @vue/cli-service in /ui Bump postcss-selector-parser and @vue/cli-service in /ui Nov 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/ui/multi-93846ae568 branch from c1d79f9 to c81863f Compare November 10, 2026 12:19

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

component:UI dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants