chore(deps): postcss security update and go dependency bumps - #645
Merged
Conversation
Bumps the catalog from 8.5.15 to 8.5.23, clearing two advisories: - GHSA-r28c-9q8g-f849, path traversal in previous-source-map auto-loading, where an attacker-controlled sourceMappingURL discloses arbitrary .map files when `from` is unset. Patched in 8.5.18. - GHSA-fxqj-rqcc-2cmp, the incomplete fix for the above. Patched in 8.5.23, which is why 8.5.18 is not enough. Running the catalog bump alone leaves the build-time CSS pipeline on the old resolution, since pnpm does not re-resolve a lockfile entry whose range is already satisfied. `pnpm update -r postcss` moves autoprefixer, cssnano and the tailwind/vite chain onto 8.5.23 as well. 8.5.23 is past the repo's 7 day minimumReleaseAge, so unlike the renovate PR it needs no minimumReleaseAgeExclude entry. stylelint and stylelint-order still hold a transitive 8.5.15 through their own `^8.5.15` range. That is dev-only linting of first-party CSS, and the paths that clear it (pnpm dedupe, or bumping stylelint) both drag unrelated transitive upgrades, so it is left for the patch sweep.
- golang.org/x/crypto 0.52.0 -> 0.54.0 (pulls golang.org/x/sys 0.47.0) - github.com/redis/go-redis/v9 9.19.0 -> 9.21.0 go build, go vet and the full backend test suite pass unchanged.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #645 +/- ##
=======================================
Coverage 28.42% 28.42%
=======================================
Files 390 390
Lines 12232 12232
Branches 1965 1965
=======================================
Hits 3477 3477
Misses 8656 8656
Partials 99 99
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This was referenced Aug 4, 2026
kelsos
added a commit
that referenced
this pull request
Aug 4, 2026
Adds a `postcss` override so the workspace resolves exactly one copy. The catalog has been on a patched postcss since #645, but a second, vulnerable 8.5.15 stayed in the lockfile: stylelint-order 8.1.1 (still the newest release) declares `postcss: ^8.5.8`, and pnpm will not re-resolve a range that is already satisfied. Dependabot reads the lockfile, so both GHSA-r28c-9q8g-f849 and GHSA-fxqj-rqcc-2cmp stayed open even though nothing we ship used the old copy. `pnpm update -r --depth Infinity postcss` does not shift it; an override is the only lever short of dropping stylelint-order. With a single forced copy the catalog also moves to 8.5.24, which no longer costs an extra duplicate. Generated CSS is byte-identical: the entry stylesheet hashes to the same `entry.BMCHlK-8.css` as before. Also here: - @unhead/vue 2.1.15 -> 2.1.16, staying on v2 because vite-ssg pins it - go-redis 9.21.0 -> 9.22.0 Verified card-payment still emits its head tags on 2.1.16, since its `useHead` has to come from the same unhead instance vite-ssg provides.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batch 1 of the renovate dashboard (#169) cleanup: the security item plus the two Go bumps.
postcss 8.5.15 → 8.5.23 (security)
Two advisories, not one:
sourceMappingURLdiscloses arbitrary.mapfiles whenfromis unset. Patched in 8.5.18.So the 8.5.18 target on my original plan was not sufficient. This goes to 8.5.23, matching what renovate's #642 now proposes.
Two differences from #642, which only edits the catalog:
pnpm update -r postcssmoves autoprefixer, cssnano and the tailwind/vite chain onto 8.5.23 as well. Verifiedpackages/websitenow resolves postcss 8.5.23.minimumReleaseAgeExcludeentry. 8.5.23 published 2026-07-24, which is past the repo's 7-dayminimumReleaseAge, so the exclude chore(deps): update dependency postcss to v8.5.23 [security] - autoclosed #642 adds is no longer needed.Known remainder
stylelintandstylelint-orderstill hold a transitive postcss 8.5.15 via their own^8.5.15range. That is dev-only linting of first-party CSS, so the advisory's attacker-controlled-sourceMappingURLprecondition does not really apply. Both ways of clearing it drag unrelated upgrades, so neither belongs in a security batch:pnpm dedupealso pulls nanoid 3.3.12→3.3.16, srvx 0.11.16→0.11.22, and a second transitive vue-router 5.1.0 alongside the catalog's 5.0.7.Left for the patch sweep batch, which already has stylelint 17.14.1 queued.
Go
golang.org/x/crypto0.52.0 → 0.54.0 (pullsgolang.org/x/sys0.47.0)github.com/redis/go-redis/v99.19.0 → 9.21.0Verification
go build ./...,go vet ./...clean; full backend suite passes (21 packages).typecheckclean,lintclean (68 pre-existing warnings, 0 errors), 476 tests pass across the 3 test packages.generatebuilds the site and 155 OG images (144 integration, 6 comparison, 5 feature), unchanged from before.Supersedes #642, which can be closed.