[MoOx]

Updates

• Affected products
• Description
• References

Comments
I maintain postcss-selector-parser and this advisory originated from a repository security advisory of mine: the GHSA was created on 2026-08-31 and published on 2026-09-03 from https://github.com/postcss/postcss-selector-parser, and CVE-2026-104844 was assigned by GitHub (assignerShortName: GitHub_M in the CVE record). No third-party CNA is involved, so this is not a correction that has to be requested upstream.

The fix has since been backported to the 6.x line and released as 6.1.5 on 2026-10-19, so the single range >= 0, < 7.1.6 is no longer accurate on two counts. It marks 6.1.5 as vulnerable although it carries the fix, and it offers no remediation within the 6.x line: the only upgrade it points at is a major version bump.

That distinction matters for this package. The 6.x line is 54.7% of its downloads (45.5M of 83.2M last week), and its most downloaded version is 6.1.2 at 17.4M a week, which is the floor of Tailwind CSS 3’s dependency range ("postcss-selector-parser": "^6.1.2"). Tailwind CSS 4 no longer depends on this package at all, so that installed base cannot reach 7.x by upgrading Tailwind. Those users currently get an alert with no non-breaking fix available, which is what prompted postcss/postcss-selector-parser#344.

Requested change, splitting the single range in two, following the convention used for other multi-branch fixes such as GHSA-c2qf-rxjj-qqgw:

= 7.0.0, < 7.1.6, patched in 7.1.6
< 6.1.5, patched in 6.1.5

Versions below 6.0.0 have no fixed release of their own, so they stay covered by the second range and are pointed at 6.1.5.

References:

6.1.5 release: https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.5
backport commit on 6.x.x: postcss/postcss-selector-parser@70b0779
original fix in 7.1.6: postcss/postcss-selector-parser@62b1917
the repository advisory already carries both ranges: GHSA-rj75-hqrm-r3gf

[github]

Hi there @MoOx! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🔵 Needs a closer look

A security curator should confirm that the published npm 6.1.5 package contains the backported fix.

No open issues 🎉

What changed in this PR

Updates the PostCSS selector-parser advisory to recognize the non-breaking security fix for 6.x users.

Changes:

• Split affected ranges around fixes in 6.1.5 and 7.1.6.
• Update patch guidance and add backport references.

File	Description
advisories/​github-reviewed/​2026/​10/​GHSA-rj75-hqrm-r3gf/​GHSA-rj75-hqrm-r3gf.json	Correct affected ranges and document the 6.x fix.

_{Review effort: Max}