[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
postcss-selector-parser	^6.1.3 → ^7.0.0

---

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

CVE-2026-104844 / GHSA-rj75-hqrm-r3gf

More information

Details

Impact

. and # are not word delimiters in the tokenizer, so a flat selector such as
.a.a.a... reaches splitWord() as a single word token carrying n class or id
indexes. Three passes scanned those index arrays linearly for every index,
making the parse O(n^2) in the number of indexes rather than in input length:
uniqs(), the indices.forEach loop, and the Sass-interpolation filter.
Parsing a 400 KB flat selector took ~34 s on a modern laptop, fully occupying a
single thread. A benign selector of identical byte size parses in tens of
milliseconds, so the cost is driven by the index count, not the input size.
The nesting depth of such a selector is 0, so the maxNestingDepth guard added
in 7.1.3 offers no protection.

Reachability is deployment dependent. Only consumers that parse untrusted,
attacker-supplied selectors synchronously in a request path are exposed, for
example CSS sanitizers, CSS-in-JS services and online playgrounds. Ordinary
build-time use on trusted sources is not affected.

Patches

Fixed in 7.1.6. The three passes now use Set membership tests, making parsing
linear in the number of indexes. There is no behaviour change: parsing is
byte-identical on a differential corpus of 8413 selectors.

Workarounds

Cap the size of selectors accepted from untrusted sources before parsing.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf
• https://nvd.nist.gov/vuln/detail/CVE-2026-104844
• https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd
• https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6
• https://github.com/advisories/GHSA-rj75-hqrm-r3gf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

postcss/postcss-selector-parser (postcss-selector-parser)

v7.1.6

Compare Source

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

v7.1.5

Compare Source

• fix: don't treat a non-prefix token before | as a namespace (#​324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#​325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#​330 by @​theRizwan)

v7.1.4

Compare Source

• fix: tolerate non-node children when serializing selectors

v7.1.3

Compare Source

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

v7.1.2

Compare Source

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#​316 by @​MoOx)

v7.1.1

Compare Source

• perf: replace startsWith with strict equality (#​308)
• fix(types): add walkUniversal declaration (#​311)

v7.1.0

Compare Source

• feat: insert(Before|After) support multiple new node

v7.0.0

Compare Source

• Feat: make insertions during iteration safe (major)

v6.1.5

Compare Source

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#​346 by @​bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x
version, and until now the only remediation on offer was an upgrade to 7.x.
6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind
CSS 3 in particular, which depends on ^6.1.2. From here on it receives security
fixes only: no features, no other bug fixes, no type changes. Everything else
goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer
depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so
npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6
ranges pick up 6.1.5 as usual.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

error This project's package.json defines "packageManager": "yarn@4.18.1". However the current global version of Yarn is 1.22.22.

Presence of the "packageManager" field indicates that the project is meant to be used with Corepack, a tool included by default with all official Node.js distributions starting from 16.9 and 14.19.
Corepack must currently be enabled by running corepack enable in your terminal. For more information, check out https://yarnpkg.com/corepack.

[netlify]

❌ Deploy Preview for openfeature failed. Why did it fail? →

Name	Link
🔨 Latest commit	f24cc10
🔍 Latest deploy log	https://app.netlify.com/projects/openfeature/deploys/6ada18d25b7f4ed5fcb6d344

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7c98a39d-9467-4a80-9a26-b05592ae8e37

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}