From 3f784b388021984b341ec674edc14bdf786becce Mon Sep 17 00:00:00 2001 From: Alan Agius <17563226+alan-agius4@users.noreply.github.com> Date: Mon, 3 Aug 2026 09:58:53 +0000 Subject: [PATCH 1/2] fix(@angular/build): upgrade postcss to 8.5.23 This addresses https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp --- packages/angular/build/package.json | 2 +- pnpm-lock.yaml | 80 +++++++++++++++++++---------- 2 files changed, 54 insertions(+), 28 deletions(-) diff --git a/packages/angular/build/package.json b/packages/angular/build/package.json index c6e01e907dff..e0aab0ac6e16 100644 --- a/packages/angular/build/package.json +++ b/packages/angular/build/package.json @@ -54,7 +54,7 @@ "jsdom": "26.1.0", "less": "4.4.0", "ng-packagr": "20.3.0", - "postcss": "8.5.12", + "postcss": "8.5.23", "rxjs": "7.8.2", "vitest": "3.2.4" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a0b320169c6f..99be99d72c10 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -441,8 +441,8 @@ importers: specifier: 20.3.0 version: 20.3.0(@angular/compiler-cli@20.3.7(@angular/compiler@20.3.7)(typescript@5.9.2))(tslib@2.8.1)(typescript@5.9.2) postcss: - specifier: 8.5.12 - version: 8.5.12 + specifier: 8.5.23 + version: 8.5.23 rxjs: specifier: 7.8.2 version: 7.8.2 @@ -4065,6 +4065,7 @@ packages: '@verdaccio/commons-api@10.2.0': resolution: {integrity: sha512-F/YZANu4DmpcEV0jronzI7v2fGVWkQ5Mwi+bVmV+ACJ+EzR0c9Jbhtbe5QyLUuzR97t8R5E/Xe53O0cc2LukdQ==} engines: {node: '>=8'} + deprecated: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. '@verdaccio/config@8.0.0-next-8.19': resolution: {integrity: sha512-08Mizx0f88A11Wxpx8EiK+mju0KroiaIRGZhV5h5+jWEKG3qucwTFNqR+29vRlPaGw1VmCEQ0+Vuaqeh03MlAA==} @@ -4270,6 +4271,7 @@ packages: '@xmldom/xmldom@0.8.11': resolution: {integrity: sha512-cQzWCtO6C8TQiYl1ruKNn2U6Ao4o4WBBcbL61yJl84x+j5sOWWFU9X7DpND8XZG3daDppSsigMdfAIl2upQBRw==} engines: {node: '>=10.0.0'} + deprecated: this version has critical issues, please update to the latest version '@xtuc/ieee754@1.2.0': resolution: {integrity: sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA==} @@ -4644,6 +4646,7 @@ packages: basic-ftp@5.0.5: resolution: {integrity: sha512-4Bcg1P8xhUuqcii/S0Z9wiHIrQVPMermM1any+MX5GeGD7faD3/msQUDGLol9wOcz4/jbg/WJnGqoJF6LiBdtg==} engines: {node: '>=10.0.0'} + deprecated: Security vulnerability fixed in 5.2.1, please upgrade batch@0.6.1: resolution: {integrity: sha512-x+VAiMRL6UPkx+kudNvxTl6hB2XNNCG2r+7wixVfIYwu/2HKRXimwQyaumLjMveWvT2Hkd/cAJw+QBMfJ/EKVw==} @@ -6028,6 +6031,7 @@ packages: git-raw-commits@5.0.0: resolution: {integrity: sha512-I2ZXrXeOc0KrCvC7swqtIFXFN+rbjnC7b2T943tvemIOVNl+XP8YnA9UVwqFhzzLClnSA60KR/qEjLpXzs73Qg==} engines: {node: '>=18'} + deprecated: Deprecated and no longer maintained. Use @conventional-changelog/git-client instead. hasBin: true glob-parent@5.1.2: @@ -6049,11 +6053,13 @@ packages: glob@10.4.5: resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==} + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me hasBin: true glob@11.0.3: resolution: {integrity: sha512-2Nim7dha1KVkaiF4q6Dj+ngPPMdfvLJEOpZk/jKiUAkqKebpGAWQXAq9z1xu9HKu5lWfqw/FASuccEjyznjPaA==} engines: {node: 20 || >=22} + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me hasBin: true glob@13.0.0: @@ -6062,7 +6068,7 @@ packages: glob@7.2.3: resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==} - deprecated: Glob versions prior to v9 are no longer supported + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me globals@14.0.0: resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==} @@ -7313,6 +7319,11 @@ packages: engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true + nanoid@3.3.16: + resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} + hasBin: true + natural-compare@1.4.0: resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} @@ -7923,6 +7934,10 @@ packages: resolution: {integrity: sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==} engines: {node: ^10 || ^12 || >=14} + postcss@8.5.23: + resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} + engines: {node: ^10 || ^12 || >=14} + prelude-ls@1.2.1: resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==} engines: {node: '>= 0.8.0'} @@ -8037,6 +8052,7 @@ packages: engines: {node: '>=0.6.0', teleport: '>=0.2.0'} deprecated: |- You or someone you depend on is using Q, the JavaScript Promise library that gave JavaScript developers strong feelings about promises. They can almost certainly migrate to the native JavaScript promise now. Thank you literally everyone for joining me in this bet against the odds. Be excellent to each other. + (For a CapTP with native promises, see @endo/eventual-send and @endo/captp) qjobs@1.2.0: @@ -8767,6 +8783,7 @@ packages: tar@7.5.1: resolution: {integrity: sha512-nlGpxf+hv0v7GkWBK2V9spgactGOp0qvfWRxUMjqHyzrt3SgwE48DIv/FhqPHJYLHpgW1opq3nERbz5Anq7n1g==} engines: {node: '>=18'} + deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me tar@7.5.4: resolution: {integrity: sha512-AN04xbWGrSTDmVwlI4/GTlIIwMFk/XEv7uL8aa57zuvRy6s4hdBed+lVq2fAZ89XDa7Us3ANXcE3Tvqvja1kTA==} @@ -9131,7 +9148,7 @@ packages: uuid@3.4.0: resolution: {integrity: sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==} - deprecated: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. + deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). hasBin: true uuid@8.3.2: @@ -9404,6 +9421,7 @@ packages: whatwg-encoding@3.1.1: resolution: {integrity: sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==} engines: {node: '>=18'} + deprecated: Use @exodus/bytes instead for a more spec-conformant and faster implementation whatwg-mimetype@4.0.0: resolution: {integrity: sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==} @@ -13895,7 +13913,7 @@ snapshots: domhandler: 5.0.3 htmlparser2: 10.0.0 picocolors: 1.1.1 - postcss: 8.5.12 + postcss: 8.5.23 postcss-media-query-parser: 0.2.3 before-after-hook@4.0.0: {} @@ -14477,12 +14495,12 @@ snapshots: css-loader@7.1.2(webpack@5.105.0(esbuild@0.28.1)): dependencies: - icss-utils: 5.1.0(postcss@8.5.12) - postcss: 8.5.12 - postcss-modules-extract-imports: 3.1.0(postcss@8.5.12) - postcss-modules-local-by-default: 4.2.0(postcss@8.5.12) - postcss-modules-scope: 3.2.1(postcss@8.5.12) - postcss-modules-values: 4.0.0(postcss@8.5.12) + icss-utils: 5.1.0(postcss@8.5.23) + postcss: 8.5.23 + postcss-modules-extract-imports: 3.1.0(postcss@8.5.23) + postcss-modules-local-by-default: 4.2.0(postcss@8.5.23) + postcss-modules-scope: 3.2.1(postcss@8.5.23) + postcss-modules-values: 4.0.0(postcss@8.5.23) postcss-value-parser: 4.2.0 semver: 7.7.2 optionalDependencies: @@ -16055,9 +16073,9 @@ snapshots: dependencies: safer-buffer: 2.1.2 - icss-utils@5.1.0(postcss@8.5.12): + icss-utils@5.1.0(postcss@8.5.23): dependencies: - postcss: 8.5.12 + postcss: 8.5.23 idb@7.1.1: {} @@ -17107,6 +17125,8 @@ snapshots: nanoid@3.3.11: {} + nanoid@3.3.16: {} + natural-compare@1.4.0: {} needle@3.3.1: @@ -17144,7 +17164,7 @@ snapshots: less: 4.4.0 ora: 8.2.0 piscina: 5.2.0 - postcss: 8.5.12 + postcss: 8.5.23 rollup-plugin-dts: 6.2.1(rollup@4.59.0)(typescript@5.9.2) rxjs: 7.8.2 sass: 1.90.0 @@ -17654,26 +17674,26 @@ snapshots: postcss-media-query-parser@0.2.3: {} - postcss-modules-extract-imports@3.1.0(postcss@8.5.12): + postcss-modules-extract-imports@3.1.0(postcss@8.5.23): dependencies: - postcss: 8.5.12 + postcss: 8.5.23 - postcss-modules-local-by-default@4.2.0(postcss@8.5.12): + postcss-modules-local-by-default@4.2.0(postcss@8.5.23): dependencies: - icss-utils: 5.1.0(postcss@8.5.12) - postcss: 8.5.12 + icss-utils: 5.1.0(postcss@8.5.23) + postcss: 8.5.23 postcss-selector-parser: 7.1.0 postcss-value-parser: 4.2.0 - postcss-modules-scope@3.2.1(postcss@8.5.12): + postcss-modules-scope@3.2.1(postcss@8.5.23): dependencies: - postcss: 8.5.12 + postcss: 8.5.23 postcss-selector-parser: 7.1.0 - postcss-modules-values@4.0.0(postcss@8.5.12): + postcss-modules-values@4.0.0(postcss@8.5.23): dependencies: - icss-utils: 5.1.0(postcss@8.5.12) - postcss: 8.5.12 + icss-utils: 5.1.0(postcss@8.5.23) + postcss: 8.5.23 postcss-selector-parser@7.1.0: dependencies: @@ -17688,6 +17708,12 @@ snapshots: picocolors: 1.1.1 source-map-js: 1.2.1 + postcss@8.5.23: + dependencies: + nanoid: 3.3.16 + picocolors: 1.1.1 + source-map-js: 1.2.1 + prelude-ls@1.2.1: {} prettier@3.6.2: {} @@ -18054,7 +18080,7 @@ snapshots: adjust-sourcemap-loader: 4.0.0 convert-source-map: 1.9.0 loader-utils: 2.0.4 - postcss: 8.5.12 + postcss: 8.5.23 source-map: 0.6.1 resolve@1.22.10: @@ -19298,7 +19324,7 @@ snapshots: esbuild: 0.27.7 fdir: 6.5.0(picomatch@4.0.4) picomatch: 4.0.4 - postcss: 8.5.12 + postcss: 8.5.23 rollup: 4.59.0 tinyglobby: 0.2.15 optionalDependencies: @@ -19316,7 +19342,7 @@ snapshots: esbuild: 0.28.1 fdir: 6.5.0(picomatch@4.0.4) picomatch: 4.0.4 - postcss: 8.5.12 + postcss: 8.5.23 rollup: 4.59.0 tinyglobby: 0.2.15 optionalDependencies: From 29f2942f3e725e51370d6004310830fddba2d0a8 Mon Sep 17 00:00:00 2001 From: Alan Agius <17563226+alan-agius4@users.noreply.github.com> Date: Mon, 3 Aug 2026 09:59:32 +0000 Subject: [PATCH 2/2] fix(@angular-devkit/build-angular): upgrade postcss to 8.5.23 This addresses https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp --- .../angular_devkit/build_angular/package.json | 2 +- pnpm-lock.yaml | 26 ++++++------------- 2 files changed, 9 insertions(+), 19 deletions(-) diff --git a/packages/angular_devkit/build_angular/package.json b/packages/angular_devkit/build_angular/package.json index 67d7e8137723..a949d0414013 100644 --- a/packages/angular_devkit/build_angular/package.json +++ b/packages/angular_devkit/build_angular/package.json @@ -43,7 +43,7 @@ "ora": "8.2.0", "picomatch": "4.0.4", "piscina": "5.2.0", - "postcss": "8.5.12", + "postcss": "8.5.23", "postcss-loader": "8.1.1", "resolve-url-loader": "5.0.0", "rxjs": "7.8.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 99be99d72c10..94727767563e 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -640,7 +640,7 @@ importers: version: 4.1.3 autoprefixer: specifier: 10.4.21 - version: 10.4.21(postcss@8.5.12) + version: 10.4.21(postcss@8.5.23) babel-loader: specifier: 10.0.0 version: 10.0.0(@babel/core@7.29.7)(webpack@5.105.0(esbuild@0.28.1)) @@ -699,11 +699,11 @@ importers: specifier: 5.2.0 version: 5.2.0 postcss: - specifier: 8.5.12 - version: 8.5.12 + specifier: 8.5.23 + version: 8.5.23 postcss-loader: specifier: 8.1.1 - version: 8.1.1(postcss@8.5.12)(typescript@5.9.2)(webpack@5.105.0(esbuild@0.28.1)) + version: 8.1.1(postcss@8.5.23)(typescript@5.9.2)(webpack@5.105.0(esbuild@0.28.1)) resolve-url-loader: specifier: 5.0.0 version: 5.0.0 @@ -7930,10 +7930,6 @@ packages: postcss-value-parser@4.2.0: resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==} - postcss@8.5.12: - resolution: {integrity: sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==} - engines: {node: ^10 || ^12 || >=14} - postcss@8.5.23: resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} engines: {node: ^10 || ^12 || >=14} @@ -13796,14 +13792,14 @@ snapshots: atomic-sleep@1.0.0: {} - autoprefixer@10.4.21(postcss@8.5.12): + autoprefixer@10.4.21(postcss@8.5.23): dependencies: browserslist: 4.26.3 caniuse-lite: 1.0.30001750 fraction.js: 4.3.7 normalize-range: 0.1.2 picocolors: 1.1.1 - postcss: 8.5.12 + postcss: 8.5.23 postcss-value-parser: 4.2.0 available-typed-arrays@1.0.7: @@ -17661,11 +17657,11 @@ snapshots: possible-typed-array-names@1.1.0: {} - postcss-loader@8.1.1(postcss@8.5.12)(typescript@5.9.2)(webpack@5.105.0(esbuild@0.28.1)): + postcss-loader@8.1.1(postcss@8.5.23)(typescript@5.9.2)(webpack@5.105.0(esbuild@0.28.1)): dependencies: cosmiconfig: 9.0.0(typescript@5.9.2) jiti: 1.21.7 - postcss: 8.5.12 + postcss: 8.5.23 semver: 7.7.2 optionalDependencies: webpack: 5.105.0(esbuild@0.28.1) @@ -17702,12 +17698,6 @@ snapshots: postcss-value-parser@4.2.0: {} - postcss@8.5.12: - dependencies: - nanoid: 3.3.11 - picocolors: 1.1.1 - source-map-js: 1.2.1 - postcss@8.5.23: dependencies: nanoid: 3.3.16