postcss 8.5.24 → 8.5.26

package/README.md

@@ -13,7 +13,7 @@ and JetBrains. The [Autoprefixer] and [Stylelint] PostCSS plugins are some o
 
 ---
 
-<img src="https://cdn.evilmartians.com/badges/logo-no-label.svg" alt="" width="22" height="16" />  PostCSS is built by <b><a href="https://evilmartians.com/>Evil Martians</a></b>, an American design and engineering consultancy for <b>developer tools, AI, and cybersecurity startups</b>.
+<img src="https://cdn.evilmartians.com/badges/logo-no-label.svg" alt="" width="22" height="16" />  PostCSS is built by <b><a href="https://evilmartians.com/">Evil Martians</a></b>, an American design and engineering consultancy for <b>developer tools, AI, and cybersecurity startups</b>.
 
 ---
 
@@ -22,3 +22,6 @@ and JetBrains. The [Autoprefixer] and [Stylelint] PostCSS plugins are some o
 [Autoprefixer]: https://github.com/postcss/autoprefixer
 [Stylelint]: https://stylelint.io/
 [plugins]: https://github.com/postcss/postcss#plugins
+
+## Docs
+Read full docs **[here](https://postcss.org/)**.

package/lib/lazy-result.js

@@ -503,14 +503,24 @@ class LazyResult {
 
     if (visit.iterator !== 0) {
       let iterator = visit.iterator
+      // Advance past the child we just finished visiting. Like
+      // `Container#each`, the index is incremented only after a child has
+      // been fully processed, so a node inserted right after the current
+      // child is not skipped by the `existIndex < index` adjustment in
+      // `Container#insertAfter()` (which would fire exit events too early).
+      if (visit.descending) {
+        visit.descending = false
+        node.indexes[iterator] += 1
+      }
       let child
       while ((child = node.nodes[node.indexes[iterator]])) {
-        node.indexes[iterator] += 1
         if (!child[isClean]) {
           child[isClean] = true
+          visit.descending = true
           stack.push(toStack(child))
           return
         }
+        node.indexes[iterator] += 1
       }
       visit.iterator = 0
       delete node.indexes[iterator]
@@ -548,12 +558,22 @@ class LazyResult {
 
       if (visit.iterator !== 0) {
         let iterator = visit.iterator
+        // Advance past the child we just finished visiting. Like
+        // `Container#each`, the index is incremented only after a child has
+        // been fully processed. Incrementing before (as this loop used to)
+        // makes a node inserted right after the current child get skipped by
+        // the `existIndex < index` adjustment in `Container#insertAfter()`,
+        // which fires exit events before those new siblings are visited.
+        if (visit.descending) {
+          visit.descending = false
+          visitNode.indexes[iterator] += 1
+        }
         let child
         let descended = false
         while ((child = visitNode.nodes[visitNode.indexes[iterator]])) {
-          visitNode.indexes[iterator] += 1
           if (!child[isClean]) {
             child[isClean] = true
+            visit.descending = true
             stack.push({
               eventIndex: 0,
               events: getEvents(child),
@@ -563,6 +583,7 @@ class LazyResult {
             descended = true
             break
           }
+          visitNode.indexes[iterator] += 1
         }
         if (descended) continue
         visit.iterator = 0

package/lib/list.js

@@ -11,6 +11,7 @@ let list = {
   },
 
   split(string, separators, last) {
+    if (typeof string !== 'string') return []
     let array = []
     let current = ''
     let split = false

package/lib/previous-map.js

@@ -1,9 +1,19 @@
 'use strict'
 
-let { existsSync, readFileSync } = require('fs')
+let { existsSync, readFileSync, realpathSync } = require('fs')
 let { dirname, isAbsolute, join, relative, sep } = require('path')
 let { SourceMapConsumer, SourceMapGenerator } = require('source-map-js')
 
+function realPath(path) {
+  try {
+    return realpathSync(path)
+  } catch {
+    // Missing or dangling: keep the literal path. The existsSync() check below
+    // still gates the read, and a path that does not exist cannot escape.
+    return path
+  }
+}
+
 function fromBase64(str) {
   if (Buffer) {
     return Buffer.from(str, 'base64').toString()
@@ -89,7 +99,9 @@ class PreviousMap {
       if (!/\.map$/i.test(path)) return undefined
       if (!cssFile) return undefined
 
-      let rel = relative(dirname(cssFile), path)
+      // Compare *resolved* paths: relative() is textual, so without this a
+      // symlink at or below the CSS file's directory points the map outside it.
+      let rel = relative(realPath(dirname(cssFile)), realPath(path))
       if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel)) {
         return undefined
       }

package/lib/processor.js

@@ -7,7 +7,7 @@ let Root = require('./root')
 
 class Processor {
   constructor(plugins = []) {
-    this.version = '8.5.24'
+    this.version = '8.5.26'
     this.plugins = this.normalize(plugins)
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postcss",
-  "version": "8.5.24",
+  "version": "8.5.26",
   "description": "Tool for transforming styles with JS plugins",
   "keywords": [
     "css",
@@ -78,7 +78,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "nanoid": "^3.3.16",
+    "nanoid": "^3.3.17",
     "picocolors": "^1.1.1",
     "source-map-js": "^1.2.1"
   },