postcss-selector-parser を 6.x から 7.x へアップグレード

- revert: the class constructor writes `value` as given again, as it did through 7.1.8. 7.2.0 escaped it, so the names CSS Modules builds (postcss-modules-scope with css-loader) were escaped a second time and their selectors stopped matching ([#362](https://github.com/postcss/postcss-selector-parser/issues/362), reported by [@denniskigen](https://github.com/denniskigen))
- revert: assigning to an id's `value` writes it as given again, as it did through 7.1.8, for the same reason. Both changes are parked for the next major ([#357](https://github.com/postcss/postcss-selector-parser/issues/357))
- fix(types): spell `Selector` without a self-referencing type alias, which TypeScript 7.1 previews reject with TS5115, while its children still exclude `Selector` ([#348](https://github.com/postcss/postcss-selector-parser/issues/348), [#350](https://github.com/postcss/postcss-selector-parser/pull/350) by [@firefoxic](https://github.com/firefoxic))
- docs: state the 7.x contract for `className` and `id` values in `API.md`

- feat: add the opt-in `maxInputLength` option, which rejects a selector longer than the limit before parsing it
- feat: support the case-sensitive attribute flag `s` per Selectors Level 4, on `Attribute#sensitive` and `Attribute#sensitiveFlag`. `[a=b s]` previously left `insensitive: false` and filed the flag in `raws.insensitiveFlag` ([#327](https://github.com/postcss/postcss-selector-parser/pull/327) by [@abhu85](https://github.com/abhu85))
- docs: add a threat model to `SECURITY.md`: resource consumption caused by unbounded untrusted input is now handled as a regular bug
- docs: document the raw-value helpers (`stringifyProperty`, `valueToString`, `setPropertyAndEscape`, `appendToPropertyAndEscape`, `setPropertyWithoutEscape`), the seventeen type guards, and the `clone()` overrides argument ([#231](https://github.com/postcss/postcss-selector-parser/issues/231))
- fix: forward the default options given to the parser factory, so `parser(fn, { maxInputLength })` and the other options take effect there as documented ([#345](https://github.com/postcss/postcss-selector-parser/pull/345) by [@Aurantium-47](https://github.com/Aurantium-47))
- fix: preserve the spaces declared on selector and root containers, through `rawSpaceBefore` and `rawSpaceAfter` ([#356](https://github.com/postcss/postcss-selector-parser/pull/356) by [@Aschenbath](https://github.com/Aschenbath))
- fix: preserve selector delimiters after an escaped backslash, so `.a\\.b` parses as two classes ([#354](https://github.com/postcss/postcss-selector-parser/pull/354) by [@wozhenbang2004](https://github.com/wozhenbang2004))
- fix: escape class values supplied to the constructor, matching what the `value` setter already did ([#349](https://github.com/postcss/postcss-selector-parser/pull/349) by [@SAY-5](https://github.com/SAY-5))
- fix: escape values assigned to an id through the `value` setter, and replace a stale `raws.value` on assignment ([#326](https://github.com/postcss/postcss-selector-parser/pull/326) by [@mahirhir](https://github.com/mahirhir))
- fix: keep `$` in an attribute name inside a preprocessor interpolation, so `[#{$attr}]` in SCSS and `[@{attr}]` in Less round-trip ([#336](https://github.com/postcss/postcss-selector-parser/pull/336) by [@theRizwan](https://github.com/theRizwan))
- fix: reject an attribute selector with no valid attribute name, instead of throwing a raw `TypeError` or emitting the literal text `undefined` ([#335](https://github.com/postcss/postcss-selector-parser/pull/335) by [@theRizwan](https://github.com/theRizwan))
- fix: keep the processor's entry points usable when destructured, as in `const { process } = parser()` ([#145](https://github.com/postcss/postcss-selector-parser/issues/145))

### Behaviour notes

- `className` and `id` values are escaped when passed to a constructor or assigned through `value`, so an already-escaped value is now escaped twice. `setPropertyWithoutEscape()` is the escape hatch. Reverted in 7.2.1.
- `[a=b s]` sets `sensitiv

- fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability ([GHSA-67xj-gfww-g738](https://github.com/advisories/GHSA-67xj-gfww-g738), reported by [@zachariah-mithani](https://github.com/zachariah-mithani))
- chore: replace the `cssesc` dependency with an internal copy, whose redundant space removal is linear

- fix: `lossless: true` preserves trailing whitespace in a selector that ends empty, such as `:not(a, )`. Note that `:not( )` now yields a selector holding one empty string node rather than an empty selector ([#337](https://github.com/postcss/postcss-selector-parser/pull/337) by [@theRizwan](https://github.com/theRizwan))
- fix: consume the whitespace that terminates a hexadecimal escape, so `[x="\000061 b"]` unescapes to `ab` ([#340](https://github.com/postcss/postcss-selector-parser/pull/340) by [@jakezwang](https://github.com/jakezwang))
- fix: set the parent on every node passed to `insertBefore` and `insertAfter`, not only the first ([#343](https://github.com/postcss/postcss-selector-parser/pull/343) by [@feritcemkahraman](https://github.com/feritcemkahraman))
- fix: assigning `combinator.value` clears the stale raw spelling instead of being ignored ([#342](https://github.com/postcss/postcss-selector-parser/pull/342) by [@SAY-5](https://github.com/SAY-5))
- fix: keep whitespace around the namespace separator in attribute selectors, so `[ foo | bar ]` round-trips ([#339](https://github.com/postcss/postcss-selector-parser/pull/339) by [@dkryaklin](https://github.com/dkryaklin))

- fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability ([CVE-2026-104844](https://github.com/advisories/GHSA-rj75-hqrm-r3gf) / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

- fix: don't treat a non-prefix token before `|` as a namespace ([#324](https://github.com/postcss/postcss-selector-parser/pull/324) by [@spokodev](https://github.com/spokodev))
- fix: preserve whitespace before a `*` namespace in attribute selectors ([#325](https://github.com/postcss/postcss-selector-parser/pull/325) by [@spokodev](https://github.com/spokodev))
- fix: TypeError on unclosed `[`, `(` and trailing `|` ([#330](https://github.com/postcss/postcss-selector-parser/pull/330) by [@theRizwan](https://github.com/theRizwan))

- fix: tolerate non-node children when serializing selectors

- Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

- Fix [CVE-2026-9358](https://github.com/advisories/GHSA-w9m9-85wc-3x92) (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 ([#316](https://github.com/postcss/postcss-selector-parser/pull/316) by [@MoOx](https://github.com/MoOx))

- perf: replace startsWith with strict equality (#308)
- fix(types): add walkUniversal declaration (#311)

- feat: insert(Before|After) support multiple new node

- Feat: make insertions during iteration safe (major)

postcss-selector-parser 6.1.6 と 7.2.1 の間で、Vigia は削除されたエクスポートを 1 件、変更されたシグネチャを 1 件、削除または変更されたクラス／インターフェースのメンバーを 9 件検出しました。

postcss-selector-parser 7.2.1 では 0 件のエクスポートまたはメンバーが新たに非推奨になりました。