PostCSS 7.0.x Release Notes

Notes

• Full package name(s) and version(s):
  • @neverendingsupport/postcss@7.0.39-postcss-7.0.41

Security Fixes

• PreviousMap:
  • Restrict automatic source map loading to .map files and ignore invalid map contents.
    • This fixes a high-severity arbitrary file read and information disclosure vulnerability (CVE-2026-45623).
  • Prevent automatic source map loading from outside the source CSS file's directory.
    • This fixes a high-severity path traversal and source map disclosure vulnerability (CVE-2026-73646).
  • Refuse to load an external source map when opts.from is unset.
    • This fixes a medium-severity path traversal and information disclosure vulnerability (CVE-2026-69153).
• Stringifier:
  • Escape HTML style-tag and comment-opening sequences with CSS Unicode escapes.
    • This fixes a medium-severity Cross-Site Scripting (XSS) vulnerability (CVE-2026-41305).
• Tokenizer:
  • Reject CSS concealed after a carriage return inside an unclosed bracket.
    • This fixes a medium-severity CSS injection vulnerability (CVE-2023-44270).

Breaking Changes

PreviousMap

• Restrict automatic source map loading to .map files and ignore invalid map contents:
  PostCSS no longer automatically loads previous source map files whose names do not end in .map. Set unsafeMap to true only when loading a trusted source map with another extension is required.
  Before:

  postcss.parse(css, { from: "input.css" });
  
  
  After:

  postcss.parse(css, { from: "input.css", unsafeMap: true });