From 1b4a5692a1fc0e0eadd1ffa639b9f5b3e3098c18 Mon Sep 17 00:00:00 2001 From: RoddyGitHub Date: Fri, 24 Jul 2026 19:39:11 +0200 Subject: [PATCH] fix(security): bump pnpm.overrides.postcss 8.5.16 -> 8.5.18 to clear pnpm audit gate CVE: Path Traversal in postcss <=8.5.17 sourceMappingURL handling (HIGH severity). Transitively affects next@16.x, vite@6.x, vitest@3.x. Bumping the override in web/pnpm-workspace.yaml forces pnpm to resolve postcss >= 8.5.18 across the dep tree. Verified locally: pnpm exec tsc --noEmit -> 0 errors; pnpm audit --audit-level=high -> clean; pnpm list --depth=Infinity postcss resolves to 8.5.18 across next/vite/vitest transitively. CI impact: Lint Web step 11 (pnpm audit) on main will re-trigger to success after this PR is merged. Signed-off-by: RoddyGitHub --- web/pnpm-lock.yaml | 12 ++++++------ web/pnpm-workspace.yaml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml index 70540a7f..69ea9f04 100644 --- a/web/pnpm-lock.yaml +++ b/web/pnpm-lock.yaml @@ -7,7 +7,7 @@ settings: overrides: vite: 6.4.3 esbuild: 0.25.12 - postcss: 8.5.16 + postcss: 8.5.18 sharp: ^0.35.0 js-yaml: ^4.3.0 @@ -1882,8 +1882,8 @@ packages: resolution: {integrity: sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==} engines: {node: '>=14.19.0'} - postcss@8.5.16: - resolution: {integrity: sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==} + postcss@8.5.18: + resolution: {integrity: sha512-xdB1oSLHbz1vRWgCDalrCqEFTWzFlhqFC5tIHLMOSUIjhm3XXQ1qrFy8S/ESr1JYRRXqM3c1QFiMZUJdUTqyMQ==} engines: {node: ^10 || ^12 || >=14} prelude-ls@1.2.1: @@ -3891,7 +3891,7 @@ snapshots: '@swc/helpers': 0.5.15 baseline-browser-mapping: 2.10.43 caniuse-lite: 1.0.30001805 - postcss: 8.5.16 + postcss: 8.5.18 react: 19.2.7 react-dom: 19.2.7(react@19.2.7) styled-jsx: 5.1.6(@babel/core@7.29.7(supports-color@10.2.2))(react@19.2.7) @@ -3991,7 +3991,7 @@ snapshots: pngjs@7.0.0: {} - postcss@8.5.16: + postcss@8.5.18: dependencies: nanoid: 3.3.16 picocolors: 1.1.1 @@ -4308,7 +4308,7 @@ snapshots: esbuild: 0.25.12 fdir: 6.5.0(picomatch@4.0.5) picomatch: 4.0.5 - postcss: 8.5.16 + postcss: 8.5.18 rollup: 4.62.2 tinyglobby: 0.2.17 optionalDependencies: diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml index 3d20e6e3..ff223949 100644 --- a/web/pnpm-workspace.yaml +++ b/web/pnpm-workspace.yaml @@ -11,6 +11,6 @@ allowBuilds: overrides: vite: 6.4.3 esbuild: 0.25.12 - postcss: 8.5.16 + postcss: 8.5.18 sharp: ^0.35.0 js-yaml: ^4.3.0