From a73c69f628bb6136f490825dda48bf2922c1b4c0 Mon Sep 17 00:00:00 2001 From: Alan Agius <17563226+alan-agius4@users.noreply.github.com> Date: Mon, 3 Aug 2026 09:56:43 +0000 Subject: [PATCH 1/2] fix(@angular/build): upgrade postcss to 8.5.23 This addresses https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp TAG=agy CONV=63a146aa-f34e-4200-88d1-90537150adb0 --- packages/angular/build/package.json | 2 +- pnpm-lock.yaml | 73 ++++++++++++++++++----------- 2 files changed, 46 insertions(+), 29 deletions(-) diff --git a/packages/angular/build/package.json b/packages/angular/build/package.json index 1939624fc71e..a4dc032e69f8 100644 --- a/packages/angular/build/package.json +++ b/packages/angular/build/package.json @@ -55,7 +55,7 @@ "jsdom": "28.1.0", "less": "4.4.2", "ng-packagr": "21.2.3", - "postcss": "8.5.12", + "postcss": "8.5.23", "rxjs": "7.8.2", "vitest": "4.0.18" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index de3388405118..4dfb81a68c26 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -436,8 +436,8 @@ importers: specifier: 21.2.3 version: 21.2.3(@angular/compiler-cli@21.2.12(@angular/compiler@21.2.12)(typescript@6.0.3))(tslib@2.8.1)(typescript@6.0.3) postcss: - specifier: 8.5.12 - version: 8.5.12 + specifier: 8.5.23 + version: 8.5.23 rxjs: specifier: 7.8.2 version: 7.8.2 @@ -7512,6 +7512,11 @@ packages: engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true + nanoid@3.3.16: + resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} + hasBin: true + natural-compare@1.4.0: resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} @@ -8076,6 +8081,10 @@ packages: resolution: {integrity: sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==} engines: {node: ^10 || ^12 || >=14} + postcss@8.5.23: + resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==} + engines: {node: ^10 || ^12 || >=14} + powershell-utils@0.1.0: resolution: {integrity: sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A==} engines: {node: '>=20'} @@ -14278,9 +14287,9 @@ snapshots: domhandler: 5.0.3 htmlparser2: 10.1.0 picocolors: 1.1.1 - postcss: 8.5.12 + postcss: 8.5.23 postcss-media-query-parser: 0.2.3 - postcss-safe-parser: 7.0.1(postcss@8.5.12) + postcss-safe-parser: 7.0.1(postcss@8.5.23) before-after-hook@4.0.0: {} @@ -14834,12 +14843,12 @@ snapshots: css-loader@7.1.3(webpack@5.105.2(esbuild@0.28.1)): dependencies: - icss-utils: 5.1.0(postcss@8.5.12) - postcss: 8.5.12 - postcss-modules-extract-imports: 3.1.0(postcss@8.5.12) - postcss-modules-local-by-default: 4.2.0(postcss@8.5.12) - postcss-modules-scope: 3.2.1(postcss@8.5.12) - postcss-modules-values: 4.0.0(postcss@8.5.12) + icss-utils: 5.1.0(postcss@8.5.23) + postcss: 8.5.23 + postcss-modules-extract-imports: 3.1.0(postcss@8.5.23) + postcss-modules-local-by-default: 4.2.0(postcss@8.5.23) + postcss-modules-scope: 3.2.1(postcss@8.5.23) + postcss-modules-values: 4.0.0(postcss@8.5.23) postcss-value-parser: 4.2.0 semver: 7.7.4 optionalDependencies: @@ -16340,9 +16349,9 @@ snapshots: dependencies: safer-buffer: 2.1.2 - icss-utils@5.1.0(postcss@8.5.12): + icss-utils@5.1.0(postcss@8.5.23): dependencies: - postcss: 8.5.12 + postcss: 8.5.23 idb@7.1.1: {} @@ -17392,6 +17401,8 @@ snapshots: nanoid@3.3.12: {} + nanoid@3.3.16: {} + natural-compare@1.4.0: {} needle@3.5.0: @@ -17429,7 +17440,7 @@ snapshots: less: 4.4.2 ora: 9.3.0 piscina: 5.2.0 - postcss: 8.5.12 + postcss: 8.5.23 rollup-plugin-dts: 6.4.1(rollup@4.57.1)(typescript@6.0.3) rxjs: 7.8.2 sass: 1.97.3 @@ -17984,30 +17995,30 @@ snapshots: postcss-media-query-parser@0.2.3: {} - postcss-modules-extract-imports@3.1.0(postcss@8.5.12): + postcss-modules-extract-imports@3.1.0(postcss@8.5.23): dependencies: - postcss: 8.5.12 + postcss: 8.5.23 - postcss-modules-local-by-default@4.2.0(postcss@8.5.12): + postcss-modules-local-by-default@4.2.0(postcss@8.5.23): dependencies: - icss-utils: 5.1.0(postcss@8.5.12) - postcss: 8.5.12 + icss-utils: 5.1.0(postcss@8.5.23) + postcss: 8.5.23 postcss-selector-parser: 7.1.1 postcss-value-parser: 4.2.0 - postcss-modules-scope@3.2.1(postcss@8.5.12): + postcss-modules-scope@3.2.1(postcss@8.5.23): dependencies: - postcss: 8.5.12 + postcss: 8.5.23 postcss-selector-parser: 7.1.1 - postcss-modules-values@4.0.0(postcss@8.5.12): + postcss-modules-values@4.0.0(postcss@8.5.23): dependencies: - icss-utils: 5.1.0(postcss@8.5.12) - postcss: 8.5.12 + icss-utils: 5.1.0(postcss@8.5.23) + postcss: 8.5.23 - postcss-safe-parser@7.0.1(postcss@8.5.12): + postcss-safe-parser@7.0.1(postcss@8.5.23): dependencies: - postcss: 8.5.12 + postcss: 8.5.23 postcss-selector-parser@7.1.1: dependencies: @@ -18022,6 +18033,12 @@ snapshots: picocolors: 1.1.1 source-map-js: 1.2.1 + postcss@8.5.23: + dependencies: + nanoid: 3.3.16 + picocolors: 1.1.1 + source-map-js: 1.2.1 + powershell-utils@0.1.0: {} prelude-ls@1.2.1: {} @@ -18370,7 +18387,7 @@ snapshots: adjust-sourcemap-loader: 4.0.0 convert-source-map: 1.9.0 loader-utils: 2.0.4 - postcss: 8.5.12 + postcss: 8.5.23 source-map: 0.6.1 resolve@1.22.12: @@ -19600,7 +19617,7 @@ snapshots: esbuild: 0.27.3 fdir: 6.5.0(picomatch@4.0.4) picomatch: 4.0.4 - postcss: 8.5.12 + postcss: 8.5.23 rollup: 4.57.1 tinyglobby: 0.2.15 optionalDependencies: @@ -19618,7 +19635,7 @@ snapshots: esbuild: 0.28.1 fdir: 6.5.0(picomatch@4.0.4) picomatch: 4.0.4 - postcss: 8.5.12 + postcss: 8.5.23 rollup: 4.57.1 tinyglobby: 0.2.15 optionalDependencies: From b1b7da04e4948ac19dfdba0015e52e8020ad8cf1 Mon Sep 17 00:00:00 2001 From: Alan Agius <17563226+alan-agius4@users.noreply.github.com> Date: Mon, 3 Aug 2026 09:57:14 +0000 Subject: [PATCH 2/2] fix(@angular-devkit/build-angular): upgrade postcss to 8.5.23 This addresses https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp TAG=agy CONV=63a146aa-f34e-4200-88d1-90537150adb0 --- .../angular_devkit/build_angular/package.json | 2 +- pnpm-lock.yaml | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/packages/angular_devkit/build_angular/package.json b/packages/angular_devkit/build_angular/package.json index 44b53ddb9ed7..40388bd56159 100644 --- a/packages/angular_devkit/build_angular/package.json +++ b/packages/angular_devkit/build_angular/package.json @@ -42,7 +42,7 @@ "ora": "9.3.0", "picomatch": "4.0.4", "piscina": "5.2.0", - "postcss": "8.5.12", + "postcss": "8.5.23", "postcss-loader": "8.2.0", "resolve-url-loader": "5.0.0", "rxjs": "7.8.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4dfb81a68c26..5c70472cba34 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -622,7 +622,7 @@ importers: version: 4.1.3 autoprefixer: specifier: 10.4.27 - version: 10.4.27(postcss@8.5.12) + version: 10.4.27(postcss@8.5.23) babel-loader: specifier: 10.0.0 version: 10.0.0(@babel/core@7.29.7)(webpack@5.105.2(esbuild@0.28.1)) @@ -678,11 +678,11 @@ importers: specifier: 5.2.0 version: 5.2.0 postcss: - specifier: 8.5.12 - version: 8.5.12 + specifier: 8.5.23 + version: 8.5.23 postcss-loader: specifier: 8.2.0 - version: 8.2.0(postcss@8.5.12)(typescript@6.0.3)(webpack@5.105.2(esbuild@0.28.1)) + version: 8.2.0(postcss@8.5.23)(typescript@6.0.3)(webpack@5.105.2(esbuild@0.28.1)) resolve-url-loader: specifier: 5.0.0 version: 5.0.0 @@ -14165,13 +14165,13 @@ snapshots: atomic-sleep@1.0.0: {} - autoprefixer@10.4.27(postcss@8.5.12): + autoprefixer@10.4.27(postcss@8.5.23): dependencies: browserslist: 4.28.2 caniuse-lite: 1.0.30001791 fraction.js: 5.3.4 picocolors: 1.1.1 - postcss: 8.5.12 + postcss: 8.5.23 postcss-value-parser: 4.2.0 available-typed-arrays@1.0.7: @@ -17982,11 +17982,11 @@ snapshots: possible-typed-array-names@1.1.0: {} - postcss-loader@8.2.0(postcss@8.5.12)(typescript@6.0.3)(webpack@5.105.2(esbuild@0.28.1)): + postcss-loader@8.2.0(postcss@8.5.23)(typescript@6.0.3)(webpack@5.105.2(esbuild@0.28.1)): dependencies: cosmiconfig: 9.0.1(typescript@6.0.3) jiti: 2.6.1 - postcss: 8.5.12 + postcss: 8.5.23 semver: 7.7.4 optionalDependencies: webpack: 5.105.2(esbuild@0.28.1) @@ -18029,7 +18029,7 @@ snapshots: postcss@8.5.12: dependencies: - nanoid: 3.3.12 + nanoid: 3.3.16 picocolors: 1.1.1 source-map-js: 1.2.1