• feat: add the opt-in maxInputLength option, which rejects a selector longer than the limit before parsing it
• feat: support the case-sensitive attribute flag s per Selectors Level 4, on Attribute#sensitive and Attribute#sensitiveFlag. [a=b s] previously left insensitive: false and filed the flag in raws.insensitiveFlag (#327 by @abhu85)
• docs: add a threat model to SECURITY.md: resource consumption caused by unbounded untrusted input is now handled as a regular bug
• docs: document the raw-value helpers (stringifyProperty, valueToString, setPropertyAndEscape, appendToPropertyAndEscape, setPropertyWithoutEscape), the seventeen type guards, and the clone() overrides argument (#231)
• fix: forward the default options given to the parser factory, so parser(fn, { maxInputLength }) and the other options take effect there as documented (#345 by @Aurantium-47)
• fix: preserve the spaces declared on selector and root containers, through rawSpaceBefore and rawSpaceAfter (#356 by @Aschenbath)
• fix: preserve selector delimiters after an escaped backslash, so .a\\.b parses as two classes (#354 by @wozhenbang2004)
• fix: escape class values supplied to the constructor, matching what the value setter already did (#349 by @SAY-5)
• fix: escape values assigned to an id through the value setter, and replace a stale raws.value on assignment (#326 by @mahirhir)
• fix: keep $ in an attribute name inside a preprocessor interpolation, so [#{$attr}] in SCSS and [@{attr}] in Less round-trip (#336 by @theRizwan)
• fix: reject an attribute selector with no valid attribute name, instead of throwing a raw TypeError or emitting the literal text undefined (#335 by @theRizwan)
• fix: keep the processor's entry points usable when destructured, as in const { process } = parser() (#145)

Behaviour notes

• className and id values are escaped when passed to a constructor or assigned through value, so an already-escaped value is now escaped twice. setPropertyWithoutEscape() is the escape hatch.
• [a=b s] sets sensitive: true rather than filing the flag in raws.insensitiveFlag. Serialization is byte-identical for i, I, s, S and non-standard flags.
• Selector and Root emit their own rawSpaceBefore and rawSpaceAfter, which changes serialization for ASTs that set them.
• An attribute selector with no attribute name raises the parser's own error rather than throwing a raw TypeError or serializing the text undefined: [ns|*] and [ * ] are affected. A trailing *, $, ^, ~ or | after a valid name is dropped, as [href=] already was.

• fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (reported by @zachariah-mithani)
• chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear

• fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (reported by @zachariah-mithani)
• chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear

• fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @theRizwan)
• fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @jakezwang)
• fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @feritcemkahraman)
• fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @SAY-5)
• fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @dkryaklin)

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#346 by @bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x
version, and until now the only remediation on offer was an upgrade to 7.x.
6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind
CSS 3 in particular, which depends on ^6.1.2. From here on it receives security
fixes only: no features, no other bug fixes, no type changes. Everything else
goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer
depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so
npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6
ranges pick up 6.1.5 as usual.

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

• fix: don't treat a non-prefix token before | as a namespace (#324 by @spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @theRizwan)

• fix: tolerate non-node children when serializing selectors

• Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

• fix: tolerate non-node children when serializing selectors