3.5.4 (from changelog)

• fix the os.machine breaking some dependents, fix #994
• add Node 16, 18, 20, 22 to CI/CD

Does any of this look wrong? Please let us know.

🚨 Information exposure in Next.js dev server due to lack of origin verification

Summary

A low-severity vulnerability in Next.js has been fixed in version 15.2.2. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active.

Because the mitigation is potentially a breaking change for some development setups, to opt-in to the fix, you must configure allowedDevOrigins in your next config after upgrading to a patched version. Learn more.

Learn more: https://vercel.com/changelog/cve-2025-48068

Credit

Thanks to sapphi-red and Radman Siddiki for responsibly disclosing this issue.

14.2.30

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport config.allowedDevOrigins (#80410) (Learn More)

Credits

Huge thanks to @ijjk and @ztanner for helping!

Does any of this look wrong? Please let us know.

8.5.6

• Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

• Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

• Fixed Parcel compatibility issue (by @git-sumitchaudhary).

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by 30 commits:

• Release 8.5.6 version
• Update dependencies
• Fix ContainerWithChildren to allow discriminating the node type by comparing its type property (#2049)
• Release 8.5.5 version
• Update dependencies
• refactor: `import` should be listed before `require` (#2052)
• Update EM text
• Release 8.5.4 version
• Update dependencies
• Fix code format
• fixed error at line 401 (#2046)
• docs: Update README.md (#2044)
• Add `postcss-fontsource-url` to plugins (#2043)
• Clarify documentation for `node.source.end.offset` (#2032)
• Fix Markdown syntax
• fix: add a mention for postcssense extension (#2040)
• Increase size
• Add `Input#fromLineAndColumn`, `CssSyntaxError.input.offset` and `CssSyntaxError.input.endOffset` (#2034)
• Fix missing offset in `Node#positionInside`, `Node#positionBy` and `Node#rangeBy` (#2033)
• Fix `opts` argument of `Node#rangeBy()` and `Node#positionBy()` cannot be omitted (#2031)
• Update dependencies
• add postcss-auto-var-fallback fallback plugin to plugins.md (#2026)
• Update Nano ID
• Change in type definition of property `css` of `result` (#2025)
• Update dependencies
• Clean up code
• Return type of method `raw` of `Stringifier` can be boolean, as the property `semicolon` can be boolean (#2024)
• There are no other `props` with non-string type.
• The return type of the method rawValue in Stringifier should be `any` instead of `string`
• Update ESLint config

3.6.2

What's Changed

• Add missing blank line around code block by @fisker in #17675

🔗 Changelog

3.6.1

• Fix "Warning: File descriptor 39 closed but not opened in unmanaged mode" error when running --experimental-cli

🔗 Changelog

3.6.0

diff

🔗 Release note "Prettier 3.6: Experimental fast CLI and new OXC and Hermes plugins!"

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by more commits than we can show here.

Too many releases to show here. View the full release notes.

See the full diff on Github. The new version differs by more commits than we can show here.

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)