build(deps): bump postcss-selector-parser from 6.1.4 to 7.1.6 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: postcss-selector-parser.

Updates postcss-selector-parser from 6.1.4 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

• fix: tolerate non-node children when serializing selectors

7.1.3

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @​MoOx)

v7.1.1

7.1.1

• perf: replace startsWith with strict equality (#308)
• fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

• feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

• Feat: make insertions during iteration safe (major)

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

• fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

• Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @​MoOx)

7.1.1

• perf: replace startsWith with strict equality (#308)
• fix(types): add walkUniversal declaration (#311)

7.1.0

• feat: insert(Before|After) support multiple new node

7.0.0

• Feat: make insertions during iteration safe (major)

6.1.2

• Fixed: erroneous trailing combinators in pseudos

6.1.1

• Fixed: improve typings of constructor helpers (#292)

6.1.0

• Feature: add sourceIndex to Selector nodes (#290)

6.0.16

... (truncated)

Commits

• 4eb3468 7.1.6
• 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
• e33e9bc 7.1.5
• 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
• 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
• e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
• dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
• 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
• See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

[Copilot]

🟡 Changes recommended

The upgrade introduces an unsupported Stylelint plugin pairing and exceeds the documented PR scope.

2 open findings

• Stylelint 17 is incompatible with stylelint-order 6.0.4 · New
• Dependency upgrades expand PR scope beyond selector parser fix · New

What changed in this PR

Updates the CSS linting dependency chain to secure postcss-selector-parser 7.1.6.

Changes:

• Upgrades Stylelint and its shared configurations.
• Refreshes the transitive dependency graph.

File	Description
package.json	Upgrades the Stylelint toolchain.
package-lock.json	Locks updated CSS tooling dependencies.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.