tiennm99/nntv
1
0 Fork 0
mirror of https://github.com/tiennm99/nntv.git synced 2026-10-16 06:14:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): force postcss >= 8.5.18 to close GHSA-r28c-9q8g-f849

Browse Source 
PostCSS auto-loaded any path named in a sourceMappingURL comment as a
previous source map, so crafted CSS could disclose arbitrary .map files.
Transitive devDependency of Vite; overridden the same way esbuild already
is, which lifts every consumer regardless of the version Vite asked for.

Resolves to 8.5.23.
This commit is contained in:
tiennm99 committed 2026-07-26 00:39:35 +07:00
1 parent dcafb100de
commit b69b4ad141
2 files changed
+15 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

pnpm-lock.yaml
Generated
+9 -8
View File
@@ -6,6 +6,7 @@ settings:
overrides:
esbuild: ^0.28.1
postcss: ^8.5.18
importers:
@@ -1528,8 +1529,8 @@ packages:
ms@2.1.3:
resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
nanoid@3.3.12:
resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==}
nanoid@3.3.16:
resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==}
engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
hasBin: true
@@ -1584,8 +1585,8 @@ packages:
resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
engines: {node: '>= 0.4'}
postcss@8.5.14:
resolution: {integrity: sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==}
postcss@8.5.23:
resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==}
engines: {node: ^10 || ^12 || >=14}
pretty-bytes@5.6.0:
@@ -3626,7 +3627,7 @@ snapshots:
ms@2.1.3: {}
nanoid@3.3.12: {}
nanoid@3.3.16: {}
node-releases@2.0.51: {}
@@ -3671,9 +3672,9 @@ snapshots:
possible-typed-array-names@1.1.0: {}
postcss@8.5.14:
postcss@8.5.23:
dependencies:
nanoid: 3.3.12
nanoid: 3.3.16
picocolors: 1.1.1
source-map-js: 1.2.1
@@ -4048,7 +4049,7 @@ snapshots:
esbuild: 0.28.1
fdir: 6.5.0(picomatch@4.0.4)
picomatch: 4.0.4
postcss: 8.5.14
postcss: 8.5.23
rollup: 4.60.3
tinyglobby: 0.2.16
optionalDependencies:
pnpm-workspace.yaml
+6
View File
@@ -4,5 +4,11 @@ allowBuilds:
# Force patched esbuild (>= 0.28.1) to close GHSA-gv7w-rqvm-qjhr
# esbuild is a transitive devDependency pulled in by Vite; pinning it here
# overrides every consumer regardless of the version Vite requested.
#
# postcss >= 8.5.18 closes GHSA-r28c-9q8g-f849: parsing CSS that carries a
# sourceMappingURL comment made PostCSS read that path off disk as a previous
# source map, so crafted CSS could disclose arbitrary .map files. Also a
# transitive devDependency of Vite.
overrides:
esbuild: ^0.28.1
postcss: ^8.5.18