Skip to content

chore(deps): update dependency postcss to v8.4.31 [security] #864

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

renovate wants to merge 1 commit into master

from renovate/npm-postcss-vulnerability

Open

chore(deps): update dependency postcss to v8.4.31 [security] #864

renovate wants to merge 1 commit into master from renovate/npm-postcss-vulnerability

Conversation

Copy link

Contributor

@renovate renovate bot commented Aug 6, 2024 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Confidence
postcss (source)	`8.4.12` -> `8.4.31`	age	confidence

GitHub Vulnerability Alerts

CVE-2023-44270

An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.

This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.

Release Notes

postcss/postcss (postcss)

`v8.4.31`

Fixed \r parsing to fix CVE-2023-44270.

`v8.4.30`

Improved source map performance (by Romain Menke).

`v8.4.29`

Fixed Node#source.offset (by Ido Rosenthal).
Fixed docs (by Christian Oliff).

`v8.4.28`

Fixed Root.source.end for better source map (by Romain Menke).
Fixed Result.root types when process() has no parser.

`v8.4.27`

Fixed Container clone methods types.

`v8.4.26`

Fixed clone methods types.

`v8.4.25`

Improve stringify performance (by Romain Menke).
Fixed docs (by @vikaskaliramna07).

`v8.4.24`

Fixed Plugin types.

`v8.4.23`

Fixed warnings in TypeDoc.

`v8.4.22`

Fixed TypeScript support with node16 (by Remco Haszing).

`v8.4.21`

Fixed Input#error types (by Aleks Hudochenkov).

`v8.4.20`

Fixed source map generation for childless at-rules like @layer.

`v8.4.19`

Fixed whitespace preserving after AST transformations (by Romain Menke).

`v8.4.18`

Fixed an error on absolute: true with empty sourceContent (by Rene Haas).

`v8.4.17`

Fixed Node.before() unexpected behavior (by Romain Menke).
Added TOC to docs (by Mikhail Dedov).

`v8.4.16`

Fixed Root AST migration.

`v8.4.15`

Fixed AST normalization after using custom parser with old PostCSS AST.

`v8.4.14`

Print "old plugin API" warning only if plugin was used (by @zardoy).

`v8.4.13`

Fixed append() error after using .parent (by Jordan Pittman).

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


 chore(deps): update dependency postcss to v8.4.31 [security]

00a4590

@renovate Renovate

Copy link

Contributor Author

renovate bot commented Aug 6, 2024 •

edited

Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

/opt/containerbase/tools/corepack/0.34.0/16.14.2/node_modules/corepack/dist/lib/corepack.cjs:22550
 const isURL = URL.canParse(range);
 ^
TypeError: URL.canParse is not a function
 at parseSpec (/opt/containerbase/tools/corepack/0.34.0/16.14.2/node_modules/corepack/dist/lib/corepack.cjs:22550:21)
 at Object.getSpec (/opt/containerbase/tools/corepack/0.34.0/16.14.2/node_modules/corepack/dist/lib/corepack.cjs:22699:20)
 at Engine.findProjectSpec (/opt/containerbase/tools/corepack/0.34.0/16.14.2/node_modules/corepack/dist/lib/corepack.cjs:22917:31)
 at async Engine.executePackageManagerRequest (/opt/containerbase/tools/corepack/0.34.0/16.14.2/node_modules/corepack/dist/lib/corepack.cjs:22956:24)
 at async Object.runMain (/opt/containerbase/tools/corepack/0.34.0/16.14.2/node_modules/corepack/dist/lib/corepack.cjs:23660:7)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment