
Security News
Next.js Patches Critical Middleware Vulnerability (CVE-2025-29927)
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
css-blank-pseudo
Advanced tools
npm install css-blank-pseudo --save-dev
PostCSS Blank Pseudo lets you style form elements when they are empty, following the Selectors Level 4 specification.
To use this feature you need to do two things :
input:blank {
background-color: yellow;
}
/* becomes */
input[blank].js-blank-pseudo, .js-blank-pseudo input[blank] {
background-color: yellow;
}
input:blank {
background-color: yellow;
}
Add PostCSS Blank Pseudo to your project:
npm install postcss css-blank-pseudo --save-dev
Use it as a PostCSS plugin:
const postcss = require('postcss');
const postcssBlankPseudo = require('css-blank-pseudo');
postcss([
postcssBlankPseudo(/* pluginOptions */)
]).process(YOUR_CSS /*, processOptions */);
The preserve
option determines whether the original notation
is preserved. By default, it is preserved.
postcssBlankPseudo({ preserve: false })
input:blank {
background-color: yellow;
}
/* becomes */
input[blank].js-blank-pseudo, .js-blank-pseudo input[blank] {
background-color: yellow;
}
The replaceWith
option determines the selector to use when replacing
the :blank
pseudo. By default is [blank]
postcssBlankPseudo({ replaceWith: '.css-blank' })
input:blank {
background-color: yellow;
}
/* becomes */
.foo {
color: blue;
color: red;
}
.baz {
color: green;
}
Note that changing this option implies that it needs to be passed to the browser polyfill as well.
The disablePolyfillReadyClass
option determines if selectors are prefixed with an indicator class.
This class is only set on your document if the polyfill loads and is needed.
By default this option is false
.
Set this to true
to prevent the class from being added.
postcssBlankPseudo({ disablePolyfillReadyClass: true })
input:blank {
background-color: yellow;
}
/* becomes */
input[blank] {
background-color: yellow;
}
input:blank {
background-color: yellow;
}
import cssBlankPseudoInit from 'css-blank-pseudo/browser';
cssBlankPseudoInit();
or
<!-- When using a CDN url you will have to manually update the version number -->
<script src="https://unpkg.com/css-blank-pseudo@7.0.1/dist/browser-global.js"></script>
<script>cssBlankPseudoInit()</script>
PostCSS Blank Pseudo works in all major browsers, including Safari 6+ and Internet Explorer 9+ without any additional polyfills.
This plugin conditionally uses MutationObserver
to ensure recently inserted
inputs get correct styling upon insertion. If you intend to rely on that
behaviour for browsers that do not support MutationObserver
, you have two
options:
MutationObserver
. As long as it runs before cssBlankPseudoInit
,
the polyfill will work.MutationObserver
you can also manually fire
a change
event upon insertion so they're automatically inspected by the
polyfill.The force
option determines whether the library runs even if the browser
supports the selector or not. By default, it won't run if the browser does
support the selector.
cssBlankPseudoInit({ force: true });
Similar to the option for the PostCSS Plugin, replaceWith
determines the
attribute or class to apply to an element when it's considered to be :blank
.
cssBlankPseudoInit({ replaceWith: '.css-blank' });
This option should be used if it was changed at PostCSS configuration level.
Please note that using a class, leverages classList
under the hood which
might not be supported on some old browsers such as IE9, so you may need
to polyfill classList
in those cases.
Given that Next.js imports packages both on the browser and on the server, you need to make sure that the package is only imported on the browser.
As outlined in the Next.js documentation, you need to load the package with a dynamic import:
useEffect(async () => {
const cssBlankPseudoInit = (await import('css-blank-pseudo/browser')).default;
cssBlankPseudoInit();
}, []);
We recommend you load the polyfill as high up on your Next application as possible, such as your pages/_app.ts
file.
FAQs
Style form elements when they are empty
The npm package css-blank-pseudo receives a total of 4,718,495 weekly downloads. As such, css-blank-pseudo popularity was classified as popular.
We found that css-blank-pseudo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
Security News
A survey of 500 cybersecurity pros reveals high pay isn't enough—lack of growth and flexibility is driving attrition and risking organizational security.
Product
Socket, the leader in open source security, is now available on Google Cloud Marketplace for simplified procurement and enhanced protection against supply chain attacks.