[dependabot]

Bumps postcss-selector-parser from 6.0.6 to 6.1.5.

Release notes

Sourced from postcss-selector-parser's releases.

6.1.5

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#346 by @​bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

6.1.4

• fix: tolerate non-node children when serializing selectors

6.1.3

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 via backport of (#316 by @​MoOx)

v6.1.2

6.1.2

• Fixed: erroneous trailing combinators in pseudos

v6.1.1

6.1.1

• Fixed: improve typings of constructor helpers (#292)

v6.1.0

6.1.0

• Feature: add sourceIndex to Selector nodes (#290)

v6.0.16

6.0.16

• Fixed: add missing index argument to each/walk callback types (#289)

v6.0.15

6.0.15

• Fixed: Node#prev and Node#next type for the first/last node

... (truncated)

Changelog

Sourced from postcss-selector-parser's changelog.

6.1.5 - 2026-10-19

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#346 by @​bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

6.1.4 - 2026-06-11

• fix: tolerate non-node children when serializing selectors

6.1.3 - 2026-06-11

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 via backport of (#316 by @​MoOx)

6.1.2

• Fixed: erroneous trailing combinators in pseudos

6.1.1

• Fixed: improve typings of constructor helpers (#292)

6.1.0

• Feature: add sourceIndex to Selector nodes (#290)

6.0.16

• Fixed: add missing index argument to each/walk callback types (#289)

6.0.15

• Fixed: Node#prev and Node#next type for the first/last node

6.0.14

... (truncated)

Commits

• d90b6e3 6.1.5
• 70b0779 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerabil...
• fb22e12 6.1.4
• 99d9299 fix: tolerate non-node children when serializing selectors
• 08ac3e5 6.1.3
• bd927e2 npm audit fix + update CI
• b6330e5 Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clo...
• 053e949 Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316)
• 1b1e9c3 chore(release): 6.1.2
• fb38876 fix: erroneous trailing combinators in pseudos
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

[netlify]

✅ Deploy Preview for firefox-devtools-react-contextmenu ready!

Name	Link
🔨 Latest commit	079f839
🔍 Latest deploy log	https://app.netlify.com/projects/firefox-devtools-react-contextmenu/deploys/6ae320dbaccdf01cbf9fbaf3
😎 Deploy Preview	https://deploy-preview-465--firefox-devtools-react-contextmenu.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.