[dependabot]

Bumps the npm_and_yarn group with 1 update in the /docs directory: postcss-selector-parser.

Updates postcss-selector-parser from 6.1.4 to 6.1.5

Release notes

Sourced from postcss-selector-parser's releases.

6.1.5

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#346 by @​bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

Changelog

Sourced from postcss-selector-parser's changelog.

6.1.5 - 2026-10-19

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#346 by @​bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

Commits

• d90b6e3 6.1.5
• 70b0779 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerabil...
• fb22e12 6.1.4
• 99d9299 fix: tolerate non-node children when serializing selectors
• 08ac3e5 6.1.3
• bd927e2 npm audit fix + update CI
• b6330e5 Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clo...
• 053e949 Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316)
• 0b773f1 fix: improve typings of constructor helpers (#292)
• 29843e3 chore(deps-dev): bump braces from 3.0.2 to 3.0.3 (#291)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: dba3b19d-d65f-48b0-9add-6f060123801c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 1 benchmark is dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 16 untouched benchmarks

---

_{Comparing dependabot/npm_and_yarn/docs/npm_and_yarn-a8587adb2e (090e9be) with main (6bf5f65)}

[frenck]

@dependabot rebase

[dependabot]

Looks like postcss-selector-parser is no longer updatable, so this is no longer needed.