HeroDevs
Visit Angular NES Home Page

PostCSS Release Notes

Comprehensive release notes and changelog for PostCSS, including security patches, bug fixes, and feature updates across all supported versions.

5 Patched Vulnerabilities
VEX Statements

v7.0.41 - September 11, 2026

Notes

  • Full package name(s) and version(s):
    • @neverendingsupport/postcss@7.0.39-postcss-7.0.41

Security Fixes

  • PreviousMap:
    • Restrict automatic source map loading to .map files and ignore invalid map contents.
      • This fixes a high-severity arbitrary file read and information disclosure vulnerability (CVE-2026-45623).
    • Prevent automatic source map loading from outside the source CSS file's directory.
      • This fixes a high-severity path traversal and source map disclosure vulnerability (CVE-2026-73646).
    • Refuse to load an external source map when opts.from is unset.
      • This fixes a medium-severity path traversal and information disclosure vulnerability (CVE-2026-69153).
  • Stringifier:
    • Escape HTML style-tag and comment-opening sequences with CSS Unicode escapes.
      • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-41305).
  • Tokenizer:
    • Reject CSS concealed after a carriage return inside an unclosed bracket.
      • This fixes a medium-severity CSS injection vulnerability (CVE-2023-44270).

Breaking Changes

PreviousMap

  • Restrict automatic source map loading to .map files and ignore invalid map contents:
    PostCSS no longer automatically loads previous source map files whose names do not end in .map. Set unsafeMap to true only when loading a trusted source map with another extension is required.
    Before:
    postcss.parse(css, { from: "input.css" });

    After:
    postcss.parse(css, { from: "input.css", unsafeMap: true });

v7.0.40 - August 28, 2026

Notes

  • This release mainlines the OSS postcss v7.0.39 into NES v7.0.40.
  • Full package name(s) and version(s):
    • @neverendingsupport/postcss@7.0.39-postcss-7.0.40