Bump postcss-selector-parser, stylelint, stylelint-config-standard and stylelint-order

[dependabot]

Bumps postcss-selector-parser to 7.1.6 and updates ancestor dependencies postcss-selector-parser, stylelint, stylelint-config-standard and stylelint-order. These dependencies need to be updated together.

Updates postcss-selector-parser from 6.0.8 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

• fix: tolerate non-node children when serializing selectors

7.1.3

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @​MoOx)

v7.1.1

7.1.1

• perf: replace startsWith with strict equality (#308)
• fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

• feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

• Feat: make insertions during iteration safe (major)

6.1.4

• fix: tolerate non-node children when serializing selectors

6.1.3

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 via backport of (#316 by @​MoOx)

v6.1.2

6.1.2

• Fixed: erroneous trailing combinators in pseudos

v6.1.1

6.1.1

• Fixed: improve typings of constructor helpers (#292)

v6.1.0

... (truncated)

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

• fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @​MoOx)

7.1.1

• perf: replace startsWith with strict equality (#308)
• fix(types): add walkUniversal declaration (#311)

7.1.0

• feat: insert(Before|After) support multiple new node

7.0.0

• Feat: make insertions during iteration safe (major)

6.1.2

• Fixed: erroneous trailing combinators in pseudos

6.1.1

• Fixed: improve typings of constructor helpers (#292)

6.1.0

• Feature: add sourceIndex to Selector nodes (#290)

6.0.16

... (truncated)

Commits

• 4eb3468 7.1.6
• 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
• e33e9bc 7.1.5
• 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
• 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
• e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
• dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
• 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
• 4a7e4e3 7.1.4
• e2021c5 fix: tolerate non-node children when serializing selectors
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates stylelint from 14.2.0 to 17.16.0

Release notes

Sourced from stylelint's releases.

17.16.0

It fixes 2 bugs in the layout-mappings rules. This will likely be the last 17.x release, as we prepare for 18.0.0.

• Fixed: property-layout-mappings and unit-layout-mappings false negatives for uppercase property names and units (#9485) (@​giaBaoJS).
• Fixed: value-keyword-layout-mappings false positives for caption-side (#9483) (@​giaBaoJS).

17.15.0

It adds 1 new rule and 2 new rule options, and fixes 4 bugs.

• Added: selector-no-unmatchable rule (#9451) (@​jeddy3).
• Added: ignoreFunctions: [] to color-named and color-no-hex (#9463) (@​jsmitty12).
• Fixed: custom-property-no-missing-var-function false positives for anchor positioning (#9466) (@​giaBaoJS).
• Fixed: declaration-block-no-redundant-longhand-properties autofix for font shorthand (#9402) (@​sarathfrancis90).
• Fixed: declaration-property-max-values false positives for interpolated inline expressions (#9437) (@​alexchen-sys).
• Fixed: selector-no-invalid false negatives for pseudo-elements, combinators and nested :has() (#9452) (@​jeddy3).

17.14.1

It fixes 4 bugs.

• Fixed: quiet option suppresses report* warning reports (#9387) (@​ychampion).
• Fixed: reported range of unknown rules (#9385) (@​ybiquitous).
• Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#9364) (@​sarathfrancis90).
• Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#9394) (@​sarathfrancis90).

17.14.0

It fixes 3 bugs, including a false negative one.

• Fixed: performance of getting module paths (#9354) (@​jeddy3).
• Fixed: performance by dynamically importing TIMING only on use (#9356) (@​jeddy3).
• Fixed: function-calc-no-unspaced-operator false negatives for unspaced + and - operators following a * or / operator (#9357) (@​sarathfrancis90).

17.13.0

It fixes 3 bugs, including a false negative one.

• Fixed: declaration-block-no-duplicate-properties false negatives for interleaved non-consecutive duplicates with ignore: ["consecutive-duplicates(-*)"] (#9324) (@​sarathfrancis90).
• Fixed: selector-max-type false positives for nested selectors (#9319) (@​romainmenke).
• Fixed: selector-type-no-unknown false positives for install (#9308) (@​Mouvedia).

17.12.0

It fixes 3 bugs, including a false negative one.

• Fixed: block-no-empty reported range when using comments (#9294) (@​romainmenke).
• Fixed: declaration-property-value-no-unknown false negatives for custom properties defined in reference files (#9292) (@​romainmenke).
• Fixed: value-keyword-layout-mappings false positives for caption-side (#9293) (@​romainmenke).

17.11.1

It fixes 2 bugs.

• Fixed: node_modules ignore for codeFilename paths containing a dot-prefixed directory (#9282) (@​tuhtah).
• Fixed: declaration-block-no-redundant-longhand-properties range for contiguous redundant longhand properties (#9273) (@​pamelalozano16).

... (truncated)

Changelog

Sourced from stylelint's changelog.

17.16.0 - 2026-10-01

It fixes 2 bugs in the layout-mappings rules. This will likely be the last 17.x release, as we prepare for 18.0.0.

• Fixed: property-layout-mappings and unit-layout-mappings false negatives for uppercase property names and units (#9485) (@​giaBaoJS).
• Fixed: value-keyword-layout-mappings false positives for caption-side (#9483) (@​giaBaoJS).

17.15.0 - 2026-09-04

It adds 1 new rule and 2 new rule options, and fixes 4 bugs.

• Added: selector-no-unmatchable rule (#9451) (@​jeddy3).
• Added: ignoreFunctions: [] to color-named and color-no-hex (#9463) (@​jsmitty12).
• Fixed: custom-property-no-missing-var-function false positives for anchor positioning (#9466) (@​giaBaoJS).
• Fixed: declaration-block-no-redundant-longhand-properties autofix for font shorthand (#9402) (@​sarathfrancis90).
• Fixed: declaration-property-max-values false positives for interpolated inline expressions (#9437) (@​alexchen-sys).
• Fixed: selector-no-invalid false negatives for pseudo-elements, combinators and nested :has() (#9452) (@​jeddy3).

17.14.1 - 2026-07-20

It fixes 4 bugs.

• Fixed: quiet option suppresses report* warning reports (#9387) (@​ychampion).
• Fixed: reported range of unknown rules (#9385) (@​ybiquitous).
• Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#9364) (@​sarathfrancis90).
• Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#9394) (@​sarathfrancis90).

17.14.0 - 2026-06-25

It fixes 3 bugs, including a false negative one.

• Fixed: performance of getting module paths (#9354) (@​jeddy3).
• Fixed: performance by dynamically importing TIMING only on use (#9356) (@​jeddy3).
• Fixed: function-calc-no-unspaced-operator false negatives for unspaced + and - operators following a * or / operator (#9357) (@​sarathfrancis90).

17.13.0 - 2026-06-06

It fixes 3 bugs, including a false negative one.

• Fixed: declaration-block-no-duplicate-properties false negatives for interleaved non-consecutive duplicates with ignore: ["consecutive-duplicates(-*)"] (#9324) (@​sarathfrancis90).
• Fixed: selector-max-type false positives for nested selectors (#9319) (@​romainmenke).
• Fixed: selector-type-no-unknown false positives for install (#9308) (@​Mouvedia).

17.12.0 - 2026-05-20

It fixes 3 bugs, including a false negative one.

• Fixed: block-no-empty reported range when using comments (#9294) (@​romainmenke).
• Fixed: declaration-property-value-no-unknown false negatives for custom properties defined in reference files (#9292) (@​romainmenke).
• Fixed: value-keyword-layout-mappings false positives for caption-side (#9293) (@​romainmenke).

... (truncated)

Commits

• bc06c7c Release 17.16.0 (#9551)
• f4fb76f Set target-branch to v18 in Dependabot config (#9488)
• 2019478 Fix property-layout-mappings and unit-layout-mappings false negatives for...
• e875710 Fix value-keyword-layout-mappings false positives for caption-side (#9483)
• 0547bff Release 17.15.0 (#9484)
• ac19a3c Fix custom-property-no-missing-var-function false positives for anchor posi...
• 23947ae Bump @​humanfs/node from 0.16.6 to 0.16.8 (#9480)
• 53c74f7 Bump fast-uri from 3.1.5 to 3.1.7 (#9481)
• 26856e6 Bump the jest group across 1 directory with 2 updates (#9476)
• b90ecd8 Bump browserslist from 4.28.4 to 4.28.8 (#9479)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for stylelint since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates stylelint-config-standard from 24.0.0 to 40.0.0

Release notes

Sourced from stylelint-config-standard's releases.

40.0.0

• Removed: stylelint less than 17.0.0 from peer dependencies.
• Removed: support for Node.js less than 20.19.0.
• Changed: updated to stylelint-config-recommended@18.0.0.
• Changed: module type to ESM.

39.0.1

• Fixed: layer-name-pattern false positives for dot notation.

39.0.0

• Removed: stylelint less than 16.23.0 from peer dependencies.
• Changed: updated to stylelint-config-recommended@17.0.0.
• Added: block-no-redundant-nested-style-rules rule.

38.0.0

• Removed: stylelint less than 16.18.0 from peer dependencies.
• Changed: updated to stylelint-config-recommended@16.0.0.
• Added: color-function-alias-notation: "without-alpha" rule.
• Added: container-name-pattern (kebab-case with optional -- prefix) rule.
• Added: layer-name-pattern (kebab-case) rule.

37.0.0

• Removed: stylelint less than 16.13.0 from peer dependencies.
• Changed: updated to stylelint-config-recommended@15.0.0.

36.0.1

• Fixed: missing funding field in package.json.

36.0.0

• Removed: stylelint less than 16.1.0 from peer dependencies.
• Added: lightness-notation: "percentage" rule.

35.0.0

• Removed: stylelint less than 16.0.0 from peer dependencies.
• Removed: Node.js less than 18.12.0 support.
• Changed: updated to stylelint-config-recommended@14.0.0.

34.0.0

• Removed: stylelint less than 15.10.0 from peer dependencies
• Changed: updated to stylelint-config-recommended@13.0.0.

33.0.0

• Removed: stylelint less than 15.5.0 from peer dependencies.
• Changed: updated to stylelint-config-recommended@12.0.0.
• Changed: restored declaration-block-single-line-max-declarations removed on 30.0.0.

32.0.0

• Removed: stylelint less than 15.4.0 from peer dependencies.
• Added: media-feature-range-notation: "context" rule

... (truncated)

Changelog

Sourced from stylelint-config-standard's changelog.

40.0.0

• Removed: stylelint less than 17.0.0 from peer dependencies.
• Removed: support for Node.js less than 20.19.0.
• Changed: updated to stylelint-config-recommended@18.0.0.
• Changed: module type to ESM.

39.0.1

• Fixed: layer-name-pattern false positives for dot notation.

39.0.0

• Removed: stylelint less than 16.23.0 from peer dependencies.
• Changed: updated to stylelint-config-recommended@17.0.0.
• Added: block-no-redundant-nested-style-rules rule.

38.0.0

• Removed: stylelint less than 16.18.0 from peer dependencies.
• Changed: updated to stylelint-config-recommended@16.0.0.
• Added: color-function-alias-notation: "without-alpha" rule.
• Added: container-name-pattern (kebab-case with optional -- prefix) rule.
• Added: layer-name-pattern (kebab-case) rule.

37.0.0

• Removed: stylelint less than 16.13.0 from peer dependencies.
• Changed: updated to stylelint-config-recommended@15.0.0.

36.0.1

• Fixed: missing funding field in package.json.

36.0.0

• Removed: stylelint less than 16.1.0 from peer dependencies.
• Added: lightness-notation: "percentage" rule.

35.0.0

• Removed: stylelint less than 16.0.0 from peer dependencies.
• Removed: Node.js less than 18.12.0 support.
• Changed: updated to stylelint-config-recommended@14.0.0.

34.0.0

• Removed: stylelint less than 15.10.0 from peer dependencies
• Changed: updated to stylelint-config-recommended@13.0.0.

... (truncated)

Commits

• fbbe7b8 Release 40.0.0 (#386)
• e6368f9 Prepare 40.0.0 (#381)
• 481e21c Bump the dev-deps group with 3 updates (#382)
• 696689d Bump stylelint/.github/.github/workflows/call-release-pr.yml from 0.3.1 to 0....
• 5d46c0f Bump stylelint/.github/.github/workflows/call-lint.yml from 0.3.1 to 0.5.0 (#...
• f888c90 Bump stylelint/.github/.github/workflows/call-test.yml from 0.3.1 to 0.5.0 (#...
• 066dda1 Fix vulnerable dependencies via npm audit fix (#378)
• b6e6aec Bump js-yaml from 4.1.0 to 4.1.1 (#379)
• 63bb8dd Bump mdast-util-to-hast from 13.1.0 to 13.2.1 (#380)
• 0cc790a Bump the dev-deps group with 2 updates (#377)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for stylelint-config-standard since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates stylelint-order from 5.0.0 to 8.1.2

Release notes

Sourced from stylelint-order's releases.

8.1.2

• Fixed compatibility with the upcoming Stylelint v18

8.1.1

• Fixed false positives for non-standard CSS (e.g. SCSS) in <style> tags, when using postcss-html custom syntax

8.1.0

• Added custom-properties-alphabetical-order rule

8.0.0

• Added limited autofix for properties in rules containing interpolation in CSS-in-JS syntax. Previosly such rules were ignored by autofix. Now groups of properties are sorted. See postcss-sorting documentation for an example.

7.0.1

• Added support for Stylelint 17

7.0.0

• Dropped Node.js 18 support
• Dropped support for Stylelint older than 16.18.0
• Changed: Ignore properties case for properties-order and properties-alphabetical-order
• Added support for more properties shorthands
• Fixed order autofix not applied, when Stylelint disable comments are present
• Fixed properties-alphabetical-order autofix not applied, when Stylelint disable comments are present
• Fixed properties-order autofix not applied, when Stylelint disable comments are present
• Fixed: Don't apply properties-alphabetical-order autofixing if there are no violations
• Fixed: Report warnings if they weren't fixed by autofix in properties-alphabetical-order

6.0.4

• Added support for Stylelint 16

6.0.3

• Fixed sorting inside CSS-in-JS css helper

6.0.2

• Added Stylelint v15 to peerDependencies

6.0.1

• Fix regression causing root of CSS or SCSS to report violations

6.0.0

• Dropped Node.js 12 and 14 support.
• Added support for postcss-styled-syntax.

Changelog

Sourced from stylelint-order's changelog.

8.1.2

• Fixed compatibility with the upcoming Stylelint v18

8.1.1

• Fixed false positives for non-standard CSS (e.g. SCSS) in <style> tags, when using postcss-html custom syntax

8.1.0

• Added custom-properties-alphabetical-order rule

8.0.0

• Added limited autofix for properties in rules containing interpolation in CSS-in-JS syntax. Previosly such rules were ignored by autofix. Now groups of properties are sorted. See postcss-sorting documentation for an example.

7.0.1

• Added support for Stylelint 17

7.0.0

• Dropped Node.js 18 support
• Dropped support for Stylelint older than 16.18.0
• Changed: Ignore properties case for properties-order and properties-alphabetical-order
• Added support for more properties shorthands
• Fixed order autofix not applied, when Stylelint disable comments are present
• Fixed properties-alphabetical-order autofix not applied, when Stylelint disable comments are present
• Fixed properties-order autofix not applied, when Stylelint disable comments are present
• Fixed: Don't apply properties-alphabetical-order autofixing if there are no violations
• Fixed: Report warnings if they weren't fixed by autofix in properties-alphabetical-order

6.0.4

• Added support for Stylelint 16

6.0.3

• Fixed sorting inside CSS-in-JS css helper

6.0.2

• Added Stylelint v15 to peerDependencies

6.0.1

• Fix regression causing root of CSS or SCSS to report violations

6.0.0

• Dropped Node.js 12 and 14 support.
• Added support for postcss-styled-syntax.

Commits

• f7d9fa8 8.1.2
• 3ca8e28 Prepare 8.1.2
• 9a53b17 Update dependencies
• 2b4f934 Fix tests with Stylelint v18 branch (#221)
• 5e0802a 8.1.1
• d63b335 Prepare 8.1.1
• 707f2d9 Change how CSS from the style attribute is detected, when using `postcss-ht...
• 7db7174 Add custom-properties-alphabetical-order in README (#214)
• 6d5b26a 8.1.0
• cfa2267 Prepare 8.1.0
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.