chore(deps): security bumps — postcss, shell-quote (AXE-3900/AXE-3901) - #272
Open
chikara1608 wants to merge 1 commit into
Open
chore(deps): security bumps — postcss, shell-quote (AXE-3900/AXE-3901)#272chikara1608 wants to merge 1 commit into
chikara1608 wants to merge 1 commit into
Conversation
Add npm overrides so these transitive dev deps resolve to non-vulnerable versions (durable across lockfile regeneration). Lockfile kept at v2. - postcss 8.5.6 -> 8.5.23 GHSA-6g55-p6wh-862q AXE-3900 - shell-quote 1.8.4 -> 1.10.0 GHSA-395f-4hp3-45gv AXE-3901 Both are dev/build-tooling only — axe-core declares no runtime dependencies, so neither ships in the published bundle: postcss <- @csstools/css-syntax-patches-for-csstree <- cssstyle <- jsdom shell-quote <- npm-run-all postcss pulls nanoid 3.3.11 -> 3.3.16 as its own dependency. [a11y-critical]: security-only dependency bumps in the axe-core submodule (package.json is JSON, so the impact tag is recorded in this message). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins two vulnerable transitive dev dependencies to patched versions via
package.jsonoverrides, so the fix survives lockfile regeneration instead of living only in the lock.sourceMappingURLparse()First-patched are 8.5.12 and 1.9.0; both go to latest-in-major, matching the versions already used elsewhere in the monorepo (
mini-percy-rendereris already on shell-quote 1.10.0).No runtime exposure
axe-core declares no
dependencies— everything isdevDependencies, so neither package ships in the published bundle:postcss←@csstools/css-syntax-patches-for-csstree←cssstyle←jsdom(test-time DOM)shell-quote←npm-run-all(build scripts)Neither advisory's attack path is reachable here: we don't run untrusted CSS through PostCSS, and we don't pass untrusted strings to
shell-quote.parse(). This is hygiene to clear the Dependabot alerts, not an incident.Notes for review
npm install --package-lock-only --lockfile-version=2); npm 10+ would otherwise migrate to v3 and produce a ~12k-line diff.nanoid3.3.11 → 3.3.16 comes along as postcss's own dependency — expected, not a separate bump.[a11y-critical]) rather than a code comment, since both changed files are JSON. Same convention as chore(deps): security bumps — axios, engine.io, brace-expansion #266.Supersedes Dependabot #269 (postcss → 8.5.22) and #271 (shell-quote → 1.10.0).
🤖 Generated with Claude Code