Skip to content

Bump postcss-selector-parser and @nx/webpack - #7

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-663a400d09
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-663a400d09

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown

Bumps postcss-selector-parser to 7.1.6 and updates ancestor dependency @nx/webpack. These dependencies need to be updated together.

Updates postcss-selector-parser from 6.1.4 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

  • fix: tolerate non-node children when serializing selectors

7.1.3

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

v7.1.1

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

  • feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

  • Feat: make insertions during iteration safe (major)
Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

7.1.0

  • feat: insert(Before|After) support multiple new node

7.0.0

  • Feat: make insertions during iteration safe (major)

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

6.1.1

  • Fixed: improve typings of constructor helpers (#292)

6.1.0

  • Feature: add sourceIndex to Selector nodes (#290)

6.0.16

... (truncated)

Commits
  • 4eb3468 7.1.6
  • 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
  • e33e9bc 7.1.5
  • 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
  • 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
  • e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
  • dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
  • 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
  • See full diff in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @nx/webpack from 18.3.5 to 23.3.0

Release notes

Sourced from @​nx/webpack's releases.

23.3.0 (2026-10-07)

🚀 Features

  • angular: support ngrx v22 (#36950)
  • angular-rspack: scaffold and run SSR apps on the @​angular/ssr application engine (#36298)
  • core: emit a runbook and per-step instructions for orchestrated migrate runs (#36766)
  • core: report the cache location alongside usage (#36959)
  • core: share one workspace walk across processes through the files archive (#36980)
  • core: hash a continuous dependency's inputs into the task it serves (#37017)
  • core: guarantee terminal output files and add an agent-friendly summary output style (#36703)
  • core: add includeIgnored filesets and let the workspace context own the daemon's watch (#37025)
  • core: cache plugin capabilities so reading them costs at most one load (#36999)
  • core: spawn one agent session for orchestrated migrate runs and land its installs and commits (#36918)
  • core: add sandbox target configuration for observed-IO opt-out (#36853)
  • core: hash tasks from Nx Cloud I/O snapshots (#37036)
  • core: replace the sandbox target property with ultracache (#37165)
  • core: opt in to selecting affected tasks instead of projects (#36825)
  • core: record unresolved migrations and cap retries in orchestrated migrate runs (#36986)
  • core: report an active orchestrated migrate run instead of resuming it (#36988)
  • core: report abandoned, revisited and resumed orchestrated migrate runs and their dispense ordinals (#36989)
  • core: turn ultracache on with NX_CLOUD_USE_ULTRACACHE (#37242)
  • core: explain why each task is affected with --explain (#36885)
  • core: run a final agent validation pass at the end of an orchestrated migrate run (#37069)
  • js: cache TypeScript reference expansion during createNodes (#37003, #37002)
  • linter: add a batched @​nx/oxlint:lint executor (#36827)
  • nx-cloud: add nx cloud demo link to cloud prompts (#36956)
  • nx-cloud: remove the never option from the nx cloud prompt (#37079)
  • repo: add a .NET example for @​nx/dotnet (#36701)
  • testing: support cypress v16 (#36953)
  • vitest: support vitest 5 (#37142)

🩹 Fixes

  • angular: correct declaration maps and exports of buildable libraries (#36373, #36357)
  • angular-rspack: keep incremental rebuild state warm when skipTypeChecking is enabled (#36972, #36970)
  • angular-rspack: keep class field closures per instance in minified builds (#37066, #37050)
  • angular-rspack: update piscina to address critical vulnerability (#37252)
  • bundling: write the esbuild bundle to an overridden outputPath (#37101, #37091)
  • bundling: clear typescript update timer when a rollup build closes its watch program (#37196)
  • core: separate daemon runtime env from graph identity (#36565, #36564)
  • core: validate the migrations path before extracting package migrations (#36887)
  • core: release per-run process listeners and task history results (#36866)
  • core: read the pnpm 12 min-release-age policy instead of deferring to an install (#36915, #36914)
  • core: carry minimumReleaseAge into pruned pnpm deploy output (#36900, #36899)
  • core: report how a plugin worker was lost instead of always calling it an exit (#36894)
  • core: keep the cache in the workspace on CI (#36922)
  • core: restore the wasm walker imports dropped by a stray cfg attribute (#36924)
  • core: avoid mutating target options when resolving configurations (#36934)
  • core: carry pnpm's package-manager document into the pruned lockfile (#36947)

... (truncated)

Commits
  • 1361436 fix(core): make glob escapes work the same on every platform (#37215)
  • 9f40a10 chore(repo): run web, vite, webpack, vitest, rollup and esbuild unit tests wi...
  • e90cfdf fix(misc): record pnpm 11 build script decisions in generators (#36814)
  • 537dd78 feat(core): hash a continuous dependency's inputs into the task it serves (#3...
  • a876d5b fix(webpack): cap the generated webpack version below 5.111.0 (#37034)
  • f61bd09 fix(core): single-inference convert-to-inferred engine with centralized confi...
  • ff0e32a fix(bundling): allow overriding the css module hash algorithm (#36837)
  • 7836228 fix(webpack): add development configuration to inferred build target (#36832)
  • aca3cec fix(react): write the dev-server port onto the generated serve target (#36589)
  • 21256d6 fix(webpack): set optimization.minimize to its normalized object form (#36815)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nx/webpack since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) to 7.1.6 and updates ancestor dependency [@nx/webpack](https://github.com/nrwl/nx/tree/HEAD/packages/webpack). These dependencies need to be updated together.


Updates `postcss-selector-parser` from 6.1.4 to 7.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@6.1.4...7.1.6)

Updates `@nx/webpack` from 18.3.5 to 23.3.0
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.3.0/packages/webpack)

---
updated-dependencies:
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
- dependency-name: "@nx/webpack"
  dependency-version: 23.3.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants