From b69b4ad141f79fb82c9b9eb9c7383ca8c7f66f4e Mon Sep 17 00:00:00 2001 From: tiennm99 Date: Sun, 26 Jul 2026 00:39:35 +0700 Subject: [PATCH] fix(deps): force postcss >= 8.5.18 to close GHSA-r28c-9q8g-f849 PostCSS auto-loaded any path named in a sourceMappingURL comment as a previous source map, so crafted CSS could disclose arbitrary .map files. Transitive devDependency of Vite; overridden the same way esbuild already is, which lifts every consumer regardless of the version Vite asked for. Resolves to 8.5.23. --- pnpm-lock.yaml | 17 +++++++++-------- pnpm-workspace.yaml | 6 ++++++ 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 251a56b..52d5d5f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,6 +6,7 @@ settings: overrides: esbuild: ^0.28.1 + postcss: ^8.5.18 importers: @@ -1528,8 +1529,8 @@ packages: ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==} - nanoid@3.3.12: - resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==} + nanoid@3.3.16: + resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -1584,8 +1585,8 @@ packages: resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==} engines: {node: '>= 0.4'} - postcss@8.5.14: - resolution: {integrity: sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==} + postcss@8.5.23: + resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} engines: {node: ^10 || ^12 || >=14} pretty-bytes@5.6.0: @@ -3626,7 +3627,7 @@ snapshots: ms@2.1.3: {} - nanoid@3.3.12: {} + nanoid@3.3.16: {} node-releases@2.0.51: {} @@ -3671,9 +3672,9 @@ snapshots: possible-typed-array-names@1.1.0: {} - postcss@8.5.14: + postcss@8.5.23: dependencies: - nanoid: 3.3.12 + nanoid: 3.3.16 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -4048,7 +4049,7 @@ snapshots: esbuild: 0.28.1 fdir: 6.5.0(picomatch@4.0.4) picomatch: 4.0.4 - postcss: 8.5.14 + postcss: 8.5.23 rollup: 4.60.3 tinyglobby: 0.2.16 optionalDependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 2c3fcbc..adc8987 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -4,5 +4,11 @@ allowBuilds: # Force patched esbuild (>= 0.28.1) to close GHSA-gv7w-rqvm-qjhr # esbuild is a transitive devDependency pulled in by Vite; pinning it here # overrides every consumer regardless of the version Vite requested. +# +# postcss >= 8.5.18 closes GHSA-r28c-9q8g-f849: parsing CSS that carries a +# sourceMappingURL comment made PostCSS read that path off disk as a previous +# source map, so crafted CSS could disclose arbitrary .map files. Also a +# transitive devDependency of Vite. overrides: esbuild: ^0.28.1 + postcss: ^8.5.18