@eslint/css-tree - npm Package Compare versions

Comparing version 3.6.8 to 3.6.9

cjs/syntax/atrule/layer.cjs

@@ -10,4 +10,4 @@ 'use strict';
         },
-        block() {
-            return this.Block(false);
+        block(nested = false, { allowNestedRules = false } = {}) {
+            return this.Block(nested, { allowNestedRules });
         }
@@ -14,0 +14,0 @@ }

cjs/syntax/node/Block.cjs

@@ -51,2 +51,3 @@ 'use strict';
 
+    // If next token is not colon, semicolon, or right curly bracket, it's likely a selector
     if (nextTokenType !== types.Colon && nextTokenType !== types.Semicolon && nextTokenType !== types.RightCurlyBracket) {
@@ -56,2 +57,41 @@ return true;
 
+    // If next token is colon, we need to look further ahead to distinguish
+    // between property declarations (p: value) and pseudo-class selectors (p:hover)
+    if (nextTokenType === types.Colon) {
+        // Look for the token after the colon (skipping whitespace)
+        const tokenAfterColon = this.lookupTypeNonSC(2);
+
+        // If it's an identifier (like 'hover', 'first-of-type') or function (like 'nth-child()', 'not()'),
+        // this could be a pseudo-class
+        if (tokenAfterColon === types.Ident || tokenAfterColon === types.Function) {
+            // Look further ahead to see if there's a left curly bracket
+            // which would indicate this is a selector with a block
+            let offset = 3;
+            let tokenType;
+
+            // Skip whitespace and look for either a left curly bracket or other tokens
+            while (offset <= 15) { // Increased limit to handle function pseudo-classes
+                tokenType = this.lookupType(offset);
+
+                if (tokenType === types.LeftCurlyBracket) {
+                    // Found opening brace, this is definitely a selector
+                    return true;
+                } else if (tokenType === types.Semicolon || tokenType === types.RightCurlyBracket) {
+                    // Found semicolon or closing brace before opening brace, likely a property
+                    return false;
+                } else if (tokenType === types.WhiteSpace || tokenType === types.Comment) {
+                    // Skip whitespace and comments
+                    offset++;
+                    continue;
+                } else {
+                    // Other tokens might indicate more complex selectors, continue looking
+                    offset++;
+                }
+            }
+        }
+
+        // If we can't determine conclusively, default to property behavior
+        return false;
+    }
+
     return false;
@@ -58,0 +98,0 @@ }

data/patch.json

@@ -652,2 +652,5 @@ {
         },
+        "color-function": {
+            "syntax": "<rgb()> | <rgba()> | <hsl()> | <hsla()> | <hwb()> | <lab()> | <lch()> | <oklab()> | <oklch()> | <alpha()> | <color()>"
+        },
         "color-mix()": {
@@ -870,2 +873,5 @@ "syntax": "color-mix( <color-interpolation-method> , [ <color> && <percentage [0,100]>? ]#{2} )"
         },
+        "alpha()": {
+            "syntax": "alpha( [ from <color> ] [ / [ <alpha-value> | none ] ]? )"
+        },
         "colorspace-params": {
@@ -872,0 +878,0 @@ "syntax": "[ <predefined-rgb-params> | <xyz-params>]"

dist/version.cjs

@@ -1,1 +0,1 @@
-module.exports = "3.6.8";
+module.exports = "3.6.9";

dist/version.js

@@ -1,1 +0,1 @@
-export const version = "3.6.8";
+export const version = "3.6.9";

lib/syntax/atrule/layer.js

@@ -8,6 +8,6 @@ export default {
         },
-        block() {
-            return this.Block(false);
+        block(nested = false, { allowNestedRules = false } = {}) {
+            return this.Block(nested, { allowNestedRules });
         }
     }
 };

lib/syntax/node/Block.js

@@ -9,2 +9,3 @@ import {
     Ident,
+    Function,
     AtKeyword,
@@ -62,2 +63,3 @@ LeftSquareBracket,
 
+    // If next token is not colon, semicolon, or right curly bracket, it's likely a selector
     if (nextTokenType !== Colon && nextTokenType !== Semicolon && nextTokenType !== RightCurlyBracket) {
@@ -67,2 +69,41 @@ return true;
 
+    // If next token is colon, we need to look further ahead to distinguish
+    // between property declarations (p: value) and pseudo-class selectors (p:hover)
+    if (nextTokenType === Colon) {
+        // Look for the token after the colon (skipping whitespace)
+        const tokenAfterColon = this.lookupTypeNonSC(2);
+
+        // If it's an identifier (like 'hover', 'first-of-type') or function (like 'nth-child()', 'not()'),
+        // this could be a pseudo-class
+        if (tokenAfterColon === Ident || tokenAfterColon === Function) {
+            // Look further ahead to see if there's a left curly bracket
+            // which would indicate this is a selector with a block
+            let offset = 3;
+            let tokenType;
+
+            // Skip whitespace and look for either a left curly bracket or other tokens
+            while (offset <= 15) { // Increased limit to handle function pseudo-classes
+                tokenType = this.lookupType(offset);
+
+                if (tokenType === LeftCurlyBracket) {
+                    // Found opening brace, this is definitely a selector
+                    return true;
+                } else if (tokenType === Semicolon || tokenType === RightCurlyBracket) {
+                    // Found semicolon or closing brace before opening brace, likely a property
+                    return false;
+                } else if (tokenType === WhiteSpace || tokenType === Comment) {
+                    // Skip whitespace and comments
+                    offset++;
+                    continue;
+                } else {
+                    // Other tokens might indicate more complex selectors, continue looking
+                    offset++;
+                }
+            }
+        }
+
+        // If we can't determine conclusively, default to property behavior
+        return false;
+    }
+
     return false;
@@ -69,0 +110,0 @@ }

package.json

 {
   "name": "@eslint/css-tree",
-  "version": "3.6.8",
+  "version": "3.6.9",
   "description": "A tool set for CSS: fast detailed parser (CSS → AST), walker (AST traversal), generator (AST → CSS) and lexer (validation and matching) based on specs and browser implementations",
@@ -5,0 +5,0 @@ "author": "Roman Dvornov <[e-mail]> (https://github.com/lahmatiy)",

README.md

@@ -204,6 +204,6 @@ <img align="right" width="111" height="111" alt="CSSTree logo" src="assets/csstree-logo-rounded.svg" />
 <h3>Platinum Sponsors</h3>
-<p><a href="https://automattic.com"><img src="https://images.opencollective.com/automattic/d0ef3e1/logo.png" alt="Automattic" height="128"></a> <a href="https://www.airbnb.com/"><img src="https://images.opencollective.com/airbnb/d327d66/logo.png" alt="Airbnb" height="128"></a></p><h3>Gold Sponsors</h3>
+<p><a href="https://automattic.com"><img src="https://images.opencollective.com/automattic/d0ef3e1/logo.png" alt="Automattic" height="128"></a></p><h3>Gold Sponsors</h3>
 <p><a href="https://qlty.sh/"><img src="https://images.opencollective.com/qltysh/33d157d/logo.png" alt="Qlty Software" height="96"></a> <a href="https://shopify.engineering/"><img src="https://avatars.githubusercontent.com/u/8085" alt="Shopify" height="96"></a></p><h3>Silver Sponsors</h3>
-<p><a href="https://vite.dev/"><img src="https://images.opencollective.com/vite/e6d15e1/logo.png" alt="Vite" height="64"></a> <a href="https://liftoff.io/"><img src="https://images.opencollective.com/liftoff/2d6c3b6/logo.png" alt="Liftoff" height="64"></a> <a href="https://americanexpress.io"><img src="https://avatars.githubusercontent.com/u/3853301" alt="American Express" height="64"></a> <a href="https://stackblitz.com"><img src="https://avatars.githubusercontent.com/u/28635252" alt="StackBlitz" height="64"></a></p><h3>Bronze Sponsors</h3>
-<p><a href="https://cybozu.co.jp/"><img src="https://images.opencollective.com/cybozu/933e46d/logo.png" alt="Cybozu" height="32"></a> <a href="https://syntax.fm"><img src="https://github.com/syntaxfm.png" alt="Syntax" height="32"></a> <a href="https://www.n-ix.com/"><img src="https://images.opencollective.com/n-ix-ltd/575a7a5/logo.png" alt="N-iX Ltd" height="32"></a> <a href="https://icons8.com/"><img src="https://images.opencollective.com/icons8/7fa1641/logo.png" alt="Icons8" height="32"></a> <a href="https://discord.com"><img src="https://images.opencollective.com/discordapp/f9645d9/logo.png" alt="Discord" height="32"></a> <a href="https://www.gitbook.com"><img src="https://avatars.githubusercontent.com/u/7111340" alt="GitBook" height="32"></a> <a href="https://nx.dev"><img src="https://avatars.githubusercontent.com/u/23692104" alt="Nx" height="32"></a> <a href="https://opensource.mercedes-benz.com/"><img src="https://avatars.githubusercontent.com/u/34240465" alt="Mercedes-Benz Group" height="32"></a> <a href="https://herocoders.com"><img src="https://avatars.githubusercontent.com/u/37549774" alt="HeroCoders" height="32"></a> <a href="https://www.lambdatest.com"><img src="https://avatars.githubusercontent.com/u/171592363" alt="LambdaTest" height="32"></a></p>
+<p><a href="https://vite.dev/"><img src="https://images.opencollective.com/vite/d472863/logo.png" alt="Vite" height="64"></a> <a href="https://liftoff.io/"><img src="https://images.opencollective.com/liftoff/2d6c3b6/logo.png" alt="Liftoff" height="64"></a> <a href="https://stackblitz.com"><img src="https://avatars.githubusercontent.com/u/28635252" alt="StackBlitz" height="64"></a></p><h3>Bronze Sponsors</h3>
+<p><a href="https://cybozu.co.jp/"><img src="https://images.opencollective.com/cybozu/933e46d/logo.png" alt="Cybozu" height="32"></a> <a href="https://opensource.sap.com"><img src="https://avatars.githubusercontent.com/u/2531208" alt="SAP" height="32"></a> <a href="https://www.crawljobs.com/"><img src="https://images.opencollective.com/crawljobs-poland/fa43a17/logo.png" alt="CrawlJobs" height="32"></a> <a href="https://depot.dev"><img src="https://images.opencollective.com/depot/39125a1/logo.png" alt="Depot" height="32"></a> <a href="https://www.n-ix.com/"><img src="https://images.opencollective.com/n-ix-ltd/575a7a5/logo.png" alt="N-iX Ltd" height="32"></a> <a href="https://icons8.com/"><img src="https://images.opencollective.com/icons8/7fa1641/logo.png" alt="Icons8" height="32"></a> <a href="https://discord.com"><img src="https://images.opencollective.com/discordapp/f9645d9/logo.png" alt="Discord" height="32"></a> <a href="https://www.gitbook.com"><img src="https://avatars.githubusercontent.com/u/7111340" alt="GitBook" height="32"></a> <a href="https://herocoders.com"><img src="https://avatars.githubusercontent.com/u/37549774" alt="HeroCoders" height="32"></a> <a href="https://www.lambdatest.com"><img src="https://avatars.githubusercontent.com/u/171592363" alt="TestMu AI Open Source Office (Formerly LambdaTest)" height="32"></a></p>
 <h3>Technology Sponsors</h3>
@@ -210,0 +210,0 @@ Technology sponsors allow us to use their products and services for free as part of a contribution to the open source ecosystem and our work.

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1472598

0.34%

Lines of code

28869

0.28%

Worsened metrics

Number of low supply chain risk alerts

109

1.87%

No dependency changes