AK-21/Graphite-Industrial-Intelligence

1# 6.1.4 - 2026-06-112 3- fix: tolerate non-node children when serializing selectors4 5# 6.1.3 - 2026-06-116 7- Fix [CVE-2026-9358](https://github.com/advisories/GHSA-w9m9-85wc-3x92) (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 via backport of ([#316](https://github.com/postcss/postcss-selector-parser/pull/316) by [@MoOx](https://github.com/MoOx))8 9# 6.1.210 11- Fixed: erroneous trailing combinators in pseudos12 13# 6.1.114 15- Fixed: improve typings of constructor helpers (#292)16 17# 6.1.018 19- Feature: add `sourceIndex` to `Selector` nodes (#290)20 21# 6.0.1622 23- Fixed: add missing `index` argument to `each`/`walk` callback types (#289)24 25# 6.0.1526 27- Fixed: Node#prev and Node#next type for the first/last node28 29# 6.0.1430 31- Fixed: type definitions32 33# 6.0.1334 35- Fixed: throw on unexpected pipe symbols36 37# 6.0.1238 39- Fixed: `clone` arguments should be optional40 41# 6.0.1142 43- Fixed: parse attribute case insensitivity flag44 45# 6.0.1046 47- Fixed: `isPseudoElement()` supports `:first-letter` and `:first-line`48 49# 6.0.950 51- Fixed: `Combinator.raws` property type52 53# 6.0.854 55- Fixed: reduced size56 57# 6.0.758 59- Fixed: parse animation percents60 61# 6.0.662 63- Fixed: parse quoted attributes containing a newline correctly64 65# 6.0.566 67- Perf: rework unesc for a 63+% performance boost68 69# 6.0.470 71- Fixed: ts errors72 73# 6.0.374 75- Fixed: replace node built-in "util" module with "util-deprecate"76- Fixed: handle uppercase pseudo elements77- Fixed: do not create invalid combinator before comment78 79# 6.0.280 81- Fixed an issue with parsing and stringifying an empty attribute value82 83# 6.0.184 85- Fixed an issue with unicode surrogate pair parsing86 87# 6.0.088 89- Updated: `cssesc` to 3.0.0 (major)90- Fixed: Issues with escaped `id` and `class` selectors91 92# 5.0.093 94- Allow escaped dot within class name.95- Update PostCSS to 7.0.7 (patch)96 97# 5.0.0-rc.498 99- Fixed an issue where comments immediately after an insensitive (in attribute)100  were not parsed correctly.101- Updated `cssesc` to 2.0.0 (major).102- Removed outdated integration tests.103- Added tests for custom selectors, tags with attributes, the universal104  selector with pseudos, and tokens after combinators.105 106# 5.0.0-rc.1107 108To ease adoption of the v5.0 release, we have relaxed the node version109check performed by npm at installation time to allow for node 4, which110remains officially unsupported, but likely to continue working for the111time being.112 113# 5.0.0-rc.0114 115This release has **BREAKING CHANGES** that were required to fix regressions116in 4.0.0 and to make the Combinator Node API consistent for all combinator117types. Please read carefully.118 119## Summary of Changes120 121* The way a descendent combinator that isn't a single space character (E.g. `.a  .b`) is stored in the AST has changed.122* Named Combinators (E.g. `.a /for/ .b`) are now properly parsed as a combinator.123* It is now possible to look up a node based on the source location of a character in that node and to query nodes if they contain some character.124* Several bug fixes that caused the parser to hang and run out of memory when a `/` was encountered have been fixed.125* The minimum supported version of Node is now `v6.0.0`.126 127### Changes to the Descendent Combinator128 129In prior releases, the value of a descendant combinator with multiple spaces included all the spaces.130 131* `.a   .b`: Extra spaces are now stored as space before.132  - Old & Busted:133    - `combinator.value === "   "`134  - New hotness:135    - `combinator.value === " " && combinator.spaces.before === "  "`136* `.a   /*comment*/.b`: A comment at the end of the combinator causes extra space to become after space.137  - Old & Busted:138    - `combinator.value === "   "`139    - `combinator.raws.value === "   /*comment/"`140  - New hotness:141    - `combinator.value === " "`142    - `combinator.spaces.after === "  "`143    - `combinator.raws.spaces.after === "  /*comment*/"`144* `.a<newline>.b`: whitespace that doesn't start or end with a single space character is stored as a raw value.145  - Old & Busted:146    - `combinator.value === "\n"`147    - `combinator.raws.value === undefined`148  - New hotness:149    - `combinator.value === " "`150    - `combinator.raws.value === "\n"`151 152### Support for "Named Combinators"153 154Although, nonstandard and unlikely to ever become a standard, combinators like `/deep/` and `/for/` are now properly supported.155 156Because they've been taken off the standardization track, there is no spec-official name for combinators of the form `/<ident>/`. However, I talked to [Tab Atkins](https://twitter.com/tabatkins) and we agreed to call them "named combinators" so now they are called that.157 158Before this release such named combinators were parsed without intention and generated three nodes of type `"tag"` where the first and last nodes had a value of `"/"`.159 160* `.a /for/ .b` is parsed as a combinator.161  - Old & Busted:162    - `root.nodes[0].nodes[1].type === "tag"`163    - `root.nodes[0].nodes[1].value === "/"`164  - New hotness:165    - `root.nodes[0].nodes[1].type === "combinator"`166    - `root.nodes[0].nodes[1].value === "/for/"`167* `.a /F\6fR/ .b` escapes are handled and uppercase is normalized.168  - Old & Busted:169    - `root.nodes[0].nodes[2].type === "tag"`170    - `root.nodes[0].nodes[2].value === "F\\6fR"`171  - New hotness:172    - `root.nodes[0].nodes[1].type === "combinator"`173    - `root.nodes[0].nodes[1].value === "/for/"`174    - `root.nodes[0].nodes[1].raws.value === "/F\\6fR/"`175 176### Source position checks and lookups177 178A new API was added to look up a node based on the source location.179 180```js181const selectorParser = require("postcss-selector-parser");182// You can find the most specific node for any given character183let combinator = selectorParser.astSync(".a > .b").atPosition(1,4);184combinator.toString() === " > ";185// You can check if a node includes a specific character186// Whitespace surrounding the node that is owned by that node187// is included in the check.188[2,3,4,5,6].map(column => combinator.isAtPosition(1, column));189// => [false, true, true, true, false]190```191 192# 4.0.0193 194This release has **BREAKING CHANGES** that were required to fix bugs regarding values with escape sequences. Please read carefully.195 196* **Identifiers with escapes** - CSS escape sequences are now hidden from the public API by default.197  The normal value of a node like a class name or ID, or an aspect of a node such as attribute198  selector's value, is unescaped. Escapes representing Non-ascii characters are unescaped into199  unicode characters. For example: `bu\tton, .\31 00, #i\2764\FE0Fu, [attr="value is \"quoted\""]`200  will parse respectively to the values `button`, `100`, `i❤️u`, `value is "quoted"`.201  The original escape sequences for these values can be found in the corresponding property name202  in `node.raws`. Where possible, deprecation warnings were added, but the nature203  of escape handling makes it impossible to detect what is escaped or not. Our expectation is204  that most users are neither expecting nor handling escape sequences in their use of this library,205  and so for them, this is a bug fix. Users who are taking care to handle escapes correctly can206  now update their code to remove the escape handling and let us do it for them.207 208* **Mutating values with escapes** - When you make an update to a node property that has escape handling209  The value is assumed to be unescaped, and any special characters are escaped automatically and210  the corresponding `raws` value is immediately updated. This can result in changes to the original211  escape format. Where the exact value of the escape sequence is important there are methods that212  allow both values to be set in conjunction. There are a number of new convenience methods for213  manipulating values that involve escapes, especially for attributes values where the quote mark214  is involved. See https://github.com/postcss/postcss-selector-parser/pull/133 for an extensive215  write-up on these changes.216 217 218**Upgrade/API Example**219 220In `3.x` there was no unescape handling and internal consistency of several properties was the caller's job to maintain. It was very easy for the developer221to create a CSS file that did not parse correctly when some types of values222were in use.223 224```js225const selectorParser = require("postcss-selector-parser");226let attr = selectorParser.attribute({attribute: "id", operator: "=", value: "a-value"});227attr.value; // => "a-value"228attr.toString(); // => [id=a-value]229// Add quotes to an attribute's value.230// All these values have to be set by the caller to be consistent:231// no internal consistency is maintained.232attr.raws.unquoted = attr.value233attr.value = "'" + attr.value + "'";234attr.value; // => "'a-value'"235attr.quoted = true;236attr.toString();  // => "[id='a-value']"237```238 239In `4.0` there is a convenient API for setting and mutating values240that may need escaping. Especially for attributes.241 242```js243const selectorParser = require("postcss-selector-parser");244 245// The constructor requires you specify the exact escape sequence246let className = selectorParser.className({value: "illegal class name", raws: {value: "illegal\\ class\\ name"}});247className.toString(); // => '.illegal\\ class\\ name'248 249// So it's better to set the value as a property250className = selectorParser.className();251// Most properties that deal with identifiers work like this252className.value = "escape for me";253className.value; // => 'escape for me'254className.toString(); // => '.escape\\ for\\ me'255 256// emoji and all non-ascii are escaped to ensure it works in every css file.257className.value = "😱🦄😍";258className.value; // => '😱🦄😍'259className.toString(); // => '.\\1F631\\1F984\\1F60D'260 261// you can control the escape sequence if you want, or do bad bad things262className.setPropertyAndEscape('value', 'xxxx', 'yyyy');263className.value; // => "xxxx"264className.toString(); // => ".yyyy"265 266// Pass a value directly through to the css output without escaping it. 267className.setPropertyWithoutEscape('value', '$REPLACE_ME$');268className.value; // => "$REPLACE_ME$"269className.toString(); // => ".$REPLACE_ME$"270 271// The biggest changes are to the Attribute class272// passing quoteMark explicitly is required to avoid a deprecation warning.273let attr = selectorParser.attribute({attribute: "id", operator: "=", value: "a-value", quoteMark: null});274attr.toString(); // => "[id=a-value]"275// Get the value with quotes on it and any necessary escapes.276// This is the same as reading attr.value in 3.x.277attr.getQuotedValue(); // => "a-value";278attr.quoteMark; // => null279 280// Add quotes to an attribute's value.281attr.quoteMark = "'"; // This is all that's required.282attr.toString(); // => "[id='a-value']"283attr.quoted; // => true284// The value is still the same, only the quotes have changed.285attr.value; // => a-value286attr.getQuotedValue(); // => "'a-value'";287 288// deprecated assignment, no warning because there's no escapes289attr.value = "new-value";290// no quote mark is needed so it is removed291attr.getQuotedValue(); // => "new-value";292 293// deprecated assignment, 294attr.value = "\"a 'single quoted' value\"";295// > (node:27859) DeprecationWarning: Assigning an attribute a value containing characters that might need to be escaped is deprecated. Call attribute.setValue() instead.296attr.getQuotedValue(); // => '"a \'single quoted\' value"';297// quote mark inferred from first and last characters.298attr.quoteMark; // => '"'299 300// setValue takes options to make manipulating the value simple.301attr.setValue('foo', {smart: true});302// foo doesn't require any escapes or quotes.303attr.toString(); // => '[id=foo]'304attr.quoteMark; // => null 305 306// An explicit quote mark can be specified307attr.setValue('foo', {quoteMark: '"'});308attr.toString(); // => '[id="foo"]'309 310// preserves quote mark by default311attr.setValue('bar');312attr.toString(); // => '[id="bar"]'313attr.quoteMark = null;314attr.toString(); // => '[id=bar]'315 316// with no arguments, it preserves quote mark even when it's not a great idea317attr.setValue('a value \n that should be quoted');318attr.toString(); // => '[id=a\\ value\\ \\A\\ that\\ should\\ be\\ quoted]'319 320// smart preservation with a specified default321attr.setValue('a value \n that should be quoted', {smart: true, preferCurrentQuoteMark: true, quoteMark: "'"});322// => "[id='a value \\A  that should be quoted']"323attr.quoteMark = '"';324// => '[id="a value \\A  that should be quoted"]'325 326// this keeps double quotes because it wants to quote the value and the existing value has double quotes.327attr.setValue('this should be quoted', {smart: true, preferCurrentQuoteMark: true, quoteMark: "'"});328// => '[id="this should be quoted"]'329 330// picks single quotes because the value has double quotes331attr.setValue('a "double quoted" value', {smart: true, preferCurrentQuoteMark: true, quoteMark: "'"});332// => "[id='a "double quoted" value']"333 334// setPropertyAndEscape lets you do anything you want. Even things that are a bad idea and illegal.335attr.setPropertyAndEscape('value', 'xxxx', 'the password is 42');336attr.value; // => "xxxx"337attr.toString(); // => "[id=the password is 42]"338 339// Pass a value directly through to the css output without escaping it. 340attr.setPropertyWithoutEscape('value', '$REPLACEMENT$');341attr.value; // => "$REPLACEMENT$"342attr.toString(); // => "[id=$REPLACEMENT$]"343```344 345# 3.1.2346 347* Fix: Removed dot-prop dependency since it's no longer written in es5.348 349# 3.1.1350 351* Fix: typescript definitions weren't in the published package.352 353# 3.1.0354 355* Fixed numerous bugs in attribute nodes relating to the handling of comments356  and whitespace. There's significant changes to `attrNode.spaces` and `attrNode.raws` since the `3.0.0` release.357* Added `Attribute#offsetOf(part)` to get the offset location of358  attribute parts like `"operator"` and `"value"`. This is most359  often added to `Attribute#sourceIndex` for error reporting.360 361# 3.0.0362 363## Breaking changes364 365* Some tweaks to the tokenizer/attribute selector parsing mean that whitespace366  locations might be slightly different to the 2.x code.367* Better attribute selector parsing with more validation; postcss-selector-parser368  no longer uses regular expressions to parse attribute selectors.369* Added an async API (thanks to @jacobp100); the default `process` API is now370  async, and the sync API is now accessed through `processSync` instead.371* `process()` and `processSync()` now return a string instead of the Processor372  instance.373* Tweaks handling of Less interpolation (thanks to @jwilsson).374* Removes support for Node 0.12.375 376## Other changes377 378* `ast()` and `astSync()` methods have been added to the `Processor`. These379  return the `Root` node of the selectors after processing them.380* `transform()` and `transformSync()` methods have been added to the381  `Processor`. These return the value returned by the processor callback382  after processing the selectors.383* Set the parent when inserting a node (thanks to @chriseppstein).384* Correctly adjust indices when using insertBefore/insertAfter (thanks to @tivac).385* Fixes handling of namespaces with qualified tag selectors.386* `process`, `ast` and `transform` (and their sync variants) now accept a387  `postcss` rule node. When provided, better errors are generated and selector388  processing is automatically set back to the rule selector (unless the `updateSelector` option is set to `false`.)389* Now more memory efficient when tokenizing selectors.390 391### Upgrade hints392 393The pattern of:394 395`rule.selector = processor.process(rule.selector).result.toString();`396 397is now:398 399`processor.processSync(rule)`400 401# 2.2.3402 403* Resolves an issue where the parser would not reduce multiple spaces between an404  ampersand and another simple selector in lossy mode (thanks to @adam-26).405 406# 2.2.2407 408* No longer hangs on an unescaped semicolon; instead the parser will throw409  an exception for these cases.410 411# 2.2.1412 413* Allows a consumer to specify whitespace tokens when creating a new Node414  (thanks to @Semigradsky).415 416# 2.2.0417 418* Added a new option to normalize whitespace when parsing the selector string419  (thanks to @adam-26).420 421# 2.1.1422 423* Better unquoted value handling within attribute selectors424  (thanks to @evilebottnawi).425 426# 2.1.0427 428* Added: Use string constants for all node types & expose them on the main429  parser instance (thanks to @Aweary).430 431# 2.0.0432 433This release contains the following breaking changes:434 435* Renamed all `eachInside` iterators to `walk`. For example, `eachTag` is now436  `walkTags`, and `eachInside` is now `walk`.437* Renamed `Node#removeSelf()` to `Node#remove()`.438* Renamed `Container#remove()` to `Container#removeChild()`.439* Renamed `Node#raw` to `Node#raws` (thanks to @davidtheclark).440* Now parses `&` as the *nesting* selector, rather than a *tag* selector.441* Fixes misinterpretation of Sass interpolation (e.g. `#{foo}`) as an442  id selector (thanks to @davidtheclark).443 444and;445 446* Fixes parsing of attribute selectors with equals signs in them447  (e.g. `[data-attr="foo=bar"]`) (thanks to @montmanu).448* Adds `quoted` and `raw.unquoted` properties to attribute nodes449  (thanks to @davidtheclark).450 451# 1.3.3452 453* Fixes an infinite loop on `)` and `]` tokens when they had no opening pairs.454  Now postcss-selector-parser will throw when it encounters these lone tokens.455 456# 1.3.2457 458* Now uses plain integers rather than `str.charCodeAt(0)` for compiled builds.459 460# 1.3.1461 462* Update flatten to v1.x (thanks to @shinnn).463 464# 1.3.0465 466* Adds a new node type, `String`, to fix a crash on selectors such as467  `foo:bar("test")`.468 469# 1.2.1470 471* Fixes a crash when the parser encountered a trailing combinator.472 473# 1.2.0474 475* A more descriptive error is thrown when the parser expects to find a476  pseudo-class/pseudo-element (thanks to @ashelley).477* Adds support for line/column locations for selector nodes, as well as a478  `Node#sourceIndex` method (thanks to @davidtheclark).479 480# 1.1.4481 482* Fixes a crash when a selector started with a `>` combinator. The module will483  now no longer throw if a selector has a leading/trailing combinator node.484 485# 1.1.3486 487* Fixes a crash on `@` tokens.488 489# 1.1.2490 491* Fixes an infinite loop caused by using parentheses in a non-pseudo element492  context.493 494# 1.1.1495 496* Fixes a crash when a backslash ended a selector string.497 498# 1.1.0499 500* Adds support for replacing multiple nodes at once with `replaceWith`501  (thanks to @jonathantneal).502* Parser no longer throws on sequential IDs and trailing commas, to support503  parsing of selector hacks.504 505# 1.0.1506 507* Fixes using `insertAfter` and `insertBefore` during iteration.508 509# 1.0.0510 511* Adds `clone` and `replaceWith` methods to nodes.512* Adds `insertBefore` and `insertAfter` to containers.513* Stabilises API.514 515# 0.0.5516 517* Fixes crash on extra whitespace inside a pseudo selector's parentheses.518* Adds sort function to the container class.519* Enables the parser to pass its input through without transforming.520* Iteration-safe `each` and `eachInside`.521 522# 0.0.4523 524* Tidy up redundant duplication.525* Fixes a bug where the parser would loop infinitely on universal selectors526  inside pseudo selectors.527* Adds `length` getter and `eachInside`, `map`, `reduce` to the container class.528* When a selector has been removed from the tree, the root node will no longer529  cast it to a string.530* Adds node type iterators to the container class (e.g. `eachComment`).531* Adds filter function to the container class.532* Adds split function to the container class.533* Create new node types by doing `parser.id(opts)` etc.534* Adds support for pseudo classes anywhere in the selector.535 536# 0.0.3537 538* Adds `next` and `prev` to the node class.539* Adds `first` and `last` getters to the container class.540* Adds `every` and `some` iterators to the container class.541* Add `empty` alias for `removeAll`.542* Combinators are now types of node.543* Fixes the at method so that it is not an alias for `index`.544* Tidy up creation of new nodes in the parser.545* Refactors how namespaces are handled for consistency & less redundant code.546* Refactors AST to use `nodes` exclusively, and eliminates excessive nesting.547* Fixes nested pseudo parsing.548* Fixes whitespace parsing.549 550# 0.0.2551 552* Adds support for namespace selectors.553* Adds support for selectors joined by escaped spaces - such as `.\31\ 0`.554 555# 0.0.1556 557* Initial release.558