Skip to content

Bump postcss-selector-parser and eslint-plugin-svelte - #161

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-55156143c8
Open

Bump postcss-selector-parser and eslint-plugin-svelte#161
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-55156143c8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps postcss-selector-parser to 7.1.6 and updates ancestor dependency eslint-plugin-svelte. These dependencies need to be updated together.

Updates postcss-selector-parser from 6.1.2 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

  • fix: tolerate non-node children when serializing selectors

7.1.3

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

v7.1.1

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

  • feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

  • Feat: make insertions during iteration safe (major)

6.1.4

  • fix: tolerate non-node children when serializing selectors

6.1.3

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

7.1.0

  • feat: insert(Before|After) support multiple new node

7.0.0

  • Feat: make insertions during iteration safe (major)
Commits
  • 4eb3468 7.1.6
  • 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
  • e33e9bc 7.1.5
  • 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
  • 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
  • e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
  • dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
  • 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
  • 4a7e4e3 7.1.4
  • e2021c5 fix: tolerate non-node children when serializing selectors
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates eslint-plugin-svelte from 2.46.1 to 3.23.1

Release notes

Sourced from eslint-plugin-svelte's releases.

eslint-plugin-svelte@3.23.1

Patch Changes

  • #1592 ed67eb7 Thanks @​baseballyama! - Exclude deprecated rules from the all configuration while keeping active rules enabled.

  • #1594 af288cd Thanks @​baseballyama! - Recognize browser from SvelteKit's $app/env alias as a browser guard in no-top-level-browser-globals.

  • #1588 9814b51 Thanks @​baseballyama! - Include all active extension rules in the Extension Rules documentation table while preserving their primary-category entries.

  • #1589 57863c5 Thanks @​baseballyama! - Keep the documented project service configuration consistent across TypeScript and Svelte files to avoid unnecessary project reloads.

  • #1593 4ad2c67 Thanks @​baseballyama! - Limit require-each-key diagnostics to the opening each tag instead of the whole block.

  • #1599 90d7b09 Thanks @​baseballyama! - Enable no-navigation-without-resolve on SvelteKit 3 so the recommended config reports internal links and navigation calls that omit resolve().

  • #1590 a28563f Thanks @​baseballyama! - Fix false positives in no-immutable-reactive-statements for TypeScript components when ecmaFeatures.globalReturn is enabled.

  • #1598 4607a2c Thanks @​baseballyama! - Recognize SvelteKit 3 in rule conditions, including prereleases, and document version detection and routes configuration.

eslint-plugin-svelte@3.23.0

Minor Changes

eslint-plugin-svelte@3.22.0

Minor Changes

eslint-plugin-svelte@3.21.0

Minor Changes

eslint-plugin-svelte@3.20.0

Minor Changes

Patch Changes

  • #1503 989bfa5 Thanks @​teemingc! - fix(valid-prop-names-in-kit-pages): drop errors from allowed page props in Svelte 5 to follow SvelteKit

eslint-plugin-svelte@3.19.0

Minor Changes

... (truncated)

Changelog

Sourced from eslint-plugin-svelte's changelog.

3.23.1

Patch Changes

  • #1592 ed67eb7 Thanks @​baseballyama! - Exclude deprecated rules from the all configuration while keeping active rules enabled.

  • #1594 af288cd Thanks @​baseballyama! - Recognize browser from SvelteKit's $app/env alias as a browser guard in no-top-level-browser-globals.

  • #1588 9814b51 Thanks @​baseballyama! - Include all active extension rules in the Extension Rules documentation table while preserving their primary-category entries.

  • #1589 57863c5 Thanks @​baseballyama! - Keep the documented project service configuration consistent across TypeScript and Svelte files to avoid unnecessary project reloads.

  • #1593 4ad2c67 Thanks @​baseballyama! - Limit require-each-key diagnostics to the opening each tag instead of the whole block.

  • #1599 90d7b09 Thanks @​baseballyama! - Enable no-navigation-without-resolve on SvelteKit 3 so the recommended config reports internal links and navigation calls that omit resolve().

  • #1590 a28563f Thanks @​baseballyama! - Fix false positives in no-immutable-reactive-statements for TypeScript components when ecmaFeatures.globalReturn is enabled.

  • #1598 4607a2c Thanks @​baseballyama! - Recognize SvelteKit 3 in rule conditions, including prereleases, and document version detection and routes configuration.

3.23.0

Minor Changes

3.22.0

Minor Changes

3.21.0

Minor Changes

3.20.0

Minor Changes

Patch Changes

  • #1503 989bfa5 Thanks @​teemingc! - fix(valid-prop-names-in-kit-pages): drop errors from allowed page props in Svelte 5 to follow SvelteKit

3.19.0

... (truncated)

Commits
  • 24201e0 chore: release eslint-plugin-svelte (#1604)
  • 90d7b09 fix(no-navigation-without-resolve): enable on SvelteKit 3 (#1599)
  • 4607a2c fix: recognize SvelteKit 3 in rule conditions (#1598)
  • af288cd fix(no-top-level-browser-globals): recognize app env browser guards (#1594)
  • 4ad2c67 fix(require-each-key): highlight only the opening tag (#1593)
  • ed67eb7 fix: omit deprecated rules from the all preset (#1592)
  • ed49083 test: show fixture paths in rule test titles (#1591)
  • a28563f fix(no-immutable-reactive-statements): handle globalReturn module scopes (#1590)
  • 57863c5 docs: share extra file extensions across typed linting (#1589)
  • 9814b51 docs: list all active extension rules in the extension table (#1588)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-plugin-svelte since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump postcss-selector-parser and eslint-plugin-svelte
6ba7011 
Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) to 7.1.6 and updates ancestor dependency [eslint-plugin-svelte](https://github.com/sveltejs/eslint-plugin-svelte/tree/HEAD/packages/eslint-plugin-svelte). These dependencies need to be updated together.


Updates `postcss-selector-parser` from 6.1.2 to 7.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v6.1.2...7.1.6)

Updates `eslint-plugin-svelte` from 2.46.1 to 3.23.1
- [Release notes](https://github.com/sveltejs/eslint-plugin-svelte/releases)
- [Changelog](https://github.com/sveltejs/eslint-plugin-svelte/blob/main/packages/eslint-plugin-svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/eslint-plugin-svelte/commits/eslint-plugin-svelte@3.23.1/packages/eslint-plugin-svelte)

---
updated-dependencies:
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
- dependency-name: eslint-plugin-svelte
  dependency-version: 3.23.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 12, 2026
@dependabot dependabot Bot mentioned this pull request Oct 12, 2026
Closed

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants