postcss 8.5.25 → 8.5.26

package/README.md

@@ -13,7 +13,7 @@ and JetBrains. The [Autoprefixer] and [Stylelint] PostCSS plugins are some o
 
 ---
 
-<img src="https://cdn.evilmartians.com/badges/logo-no-label.svg" alt="" width="22" height="16" />  PostCSS is built by <b><a href="https://evilmartians.com/>Evil Martians</a></b>, an American design and engineering consultancy for <b>developer tools, AI, and cybersecurity startups</b>.
+<img src="https://cdn.evilmartians.com/badges/logo-no-label.svg" alt="" width="22" height="16" />  PostCSS is built by <b><a href="https://evilmartians.com/">Evil Martians</a></b>, an American design and engineering consultancy for <b>developer tools, AI, and cybersecurity startups</b>.
 
 ---
 
@@ -22,3 +22,6 @@ and JetBrains. The [Autoprefixer] and [Stylelint] PostCSS plugins are some o
 [Autoprefixer]: https://github.com/postcss/autoprefixer
 [Stylelint]: https://stylelint.io/
 [plugins]: https://github.com/postcss/postcss#plugins
+
+## Docs
+Read full docs **[here](https://postcss.org/)**.

package/lib/list.js

@@ -11,7 +11,7 @@ let list = {
   },
 
   split(string, separators, last) {
-    if (!string) return []
+    if (typeof string !== 'string') return []
     let array = []
     let current = ''
     let split = false

package/lib/previous-map.js

@@ -1,9 +1,19 @@
 'use strict'
 
-let { existsSync, readFileSync } = require('fs')
+let { existsSync, readFileSync, realpathSync } = require('fs')
 let { dirname, isAbsolute, join, relative, sep } = require('path')
 let { SourceMapConsumer, SourceMapGenerator } = require('source-map-js')
 
+function realPath(path) {
+  try {
+    return realpathSync(path)
+  } catch {
+    // Missing or dangling: keep the literal path. The existsSync() check below
+    // still gates the read, and a path that does not exist cannot escape.
+    return path
+  }
+}
+
 function fromBase64(str) {
   if (Buffer) {
     return Buffer.from(str, 'base64').toString()
@@ -89,7 +99,9 @@ class PreviousMap {
       if (!/\.map$/i.test(path)) return undefined
       if (!cssFile) return undefined
 
-      let rel = relative(dirname(cssFile), path)
+      // Compare *resolved* paths: relative() is textual, so without this a
+      // symlink at or below the CSS file's directory points the map outside it.
+      let rel = relative(realPath(dirname(cssFile)), realPath(path))
       if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel)) {
         return undefined
       }

package/lib/processor.js

@@ -7,7 +7,7 @@ let Root = require('./root')
 
 class Processor {
   constructor(plugins = []) {
-    this.version = '8.5.25'
+    this.version = '8.5.26'
     this.plugins = this.normalize(plugins)
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postcss",
-  "version": "8.5.25",
+  "version": "8.5.26",
   "description": "Tool for transforming styles with JS plugins",
   "keywords": [
     "css",
@@ -78,7 +78,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "nanoid": "^3.3.16",
+    "nanoid": "^3.3.17",
     "picocolors": "^1.1.1",
     "source-map-js": "^1.2.1"
   },