[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps postcss-selector-parser from 7.1.5 to 7.1.7.

Release notes

Sourced from postcss-selector-parser's releases.

7.1.7

• fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @​theRizwan)
• fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @​jakezwang)
• fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @​feritcemkahraman)
• fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @​SAY-5)
• fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @​dkryaklin)

7.1.6

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.7 - 2026-10-19

• fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @​theRizwan)
• fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @​jakezwang)
• fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @​feritcemkahraman)
• fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @​SAY-5)
• fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @​dkryaklin)

7.1.6 - 2026-09-03

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

Commits

• 154c2b0 7.1.7
• e8dc65f docs: add CVE-2026-104844 to the 7.1.6 changelog entry
• d5122b0 fix: keep whitespace around the namespace separator in attribute selectors (#...
• 80ab254 fix: invalidate stale raw spelling on combinator value assignment (#342)
• ba353c7 fix: set parents for all variadic inserted nodes (#343)
• 8b2d16d Consume whitespace after hexadecimal CSS escapes (#340)
• 8f10b8d fix: lossless mode drops whitespace when a selector ends empty (#337)
• 15c2b45 chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 (#347)
• 4eb3468 7.1.6
• 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
• See full diff in compare view

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[AchoArnold]

Merged locally into main in commit 1b5edf5 and pushed together with the other frontend Dependabot updates. Dependabot refreshed this PR branch during integration, so GitHub did not automatically mark it merged.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.