Bump postcss and brace-expansion for two new upstream advisories#327
Open
samrusani wants to merge 3 commits into
Open
Bump postcss and brace-expansion for two new upstream advisories#327samrusani wants to merge 3 commits into
samrusani wants to merge 3 commits into
Conversation
GHSA-r28c-9q8g-f849 covers postcss through 8.5.17 and lands after the 8.5.12 bump three days ago, which addressed a different advisory in the same package. Moves through the existing pnpm override. Local validation: production advisory audit reports 0 matching advisories, 236 web tests pass, typecheck clean, production build compiles.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
postcss 8.5.12 became affected by a sourceMappingURL path traversal covering everything up to 8.5.17 (GHSA-r28c-9q8g-f849), three days after it was raised to 8.5.12 for a different postcss issue. Move to 8.5.18. brace-expansion picked up an unbounded-expansion denial of service covering everything up to 5.0.7 (GHSA-mh99-v99m-4gvg). The two existing ranged overrides pinned 1.1.16 and 5.0.7, both now affected, and neither the 1.x nor the 2.x line has a patched release, so the ranges are replaced by a single pin to 5.0.8. That is a major jump for the transitive consumers, all of which are development tooling; the package is absent from the production audit set. Local validation: production audit 0 findings, full audit 0 findings, 236 web tests pass, lint clean, production build compiles.
samrusani
changed the title
postcss 8.5.12 became affected by GHSA-r28c-9q8g-f849, a path traversal via sourceMappingURL covering everything up to 8.5.17, three days after it was raised to 8.5.12 for a different postcss advisory. The production audit is clean again. The brace-expansion advisory GHSA-mh99-v99m-4gvg is deliberately not addressed here. It covers everything up to 5.0.7, the remaining affected versions are 1.1.16 and 2.1.2, and neither major line has a patched release. Forcing the whole tree to 5.0.8 requires minimatch 10, which is ESM-only with no default export, which eslint cannot load. There is no version combination that satisfies the toolchain today, so the remediation is an owner decision rather than a dependency change. Local validation: production audit 0 findings, coverage gates, lint and build all pass. The full audit still reports the one dev-only advisory.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two advisories published upstream since the last dependency bump, both blocking every PR's web job rather than anything in these branches.
Local validation: production audit 0 findings, full audit 0 findings, 236 web tests pass, lint clean, production build compiles. Versions untouched at 0.14.0.