# What changed in postcss-selector-parser

> 6 changes in postcss-selector-parser 7 from its official release notes, upgrade guides and advisories: 1 breaking, 2 security. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/postcss-selector-parser/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## postcss-selector-parser 7

### Breaking changes

- A non-prefix token before `|` is no longer treated as a namespace. (7.1.5) — [release notes](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.5)

### Security

- PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion (7.1.6) — [security advisory](https://github.com/advisories/GHSA-RJ75-HQRM-R3GF), [release notes](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6)
- postcss-selector-parser allows denial of service through uncontrolled AST recursion (6.1.3, 7.1.3) — [security advisory](https://github.com/advisories/GHSA-W9M9-85WC-3X92)

### Fixes and other changes

- Whitespace before a `*` namespace in attribute selectors is preserved. (7.1.5) — [release notes](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.5)
- Fixes a TypeError on unclosed `[`, `(` and trailing `|`. (7.1.5) — [release notes](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.5)
- Selector serialization now tolerates non-node children. (7.1.4) — [release notes](https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.4)