From 23002c65e2ca840da94831f1d0e1adc2da4f7d56 Mon Sep 17 00:00:00 2001 From: Randy Hammond Date: Sat, 25 Apr 2026 22:49:56 +0000 Subject: [PATCH] fix(deps): pin postcss >=8.5.10 (CVE; pnpm override) Resolves the Dependabot alert: PostCSS XSS via unescaped in CSS stringify output. PostCSS is a dev-only transitive of Vite/Tailwind and never reaches the production runtime, but pinning it removes the alert and ensures contributors build against the patched version. Bumps frontend version to 1.2.1. --- CHANGELOG.md | 6 ++++++ frontend/package.json | 7 +++++-- frontend/pnpm-lock.yaml | 11 +++++++---- 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index baac1b4..999fd03 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [1.2.1] — 2026-04-25 + +### Security + +- Pin transitive `postcss` to `>=8.5.10` via a pnpm override to address GHSA / CVE: "PostCSS has XSS via Unescaped `` in its CSS Stringify Output" (medium). PostCSS is a dev-only dependency pulled in by Vite/Tailwind and never reaches the production runtime, but the override removes the Dependabot alert and ensures contributors building from source pick up the patched version. + ## [1.2.0] — 2026-04-25 ### Added diff --git a/frontend/package.json b/frontend/package.json index 73a4c41..44ff7bb 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,7 +1,7 @@ { "name": "openscanner-frontend", "private": true, - "version": "1.2.0", + "version": "1.2.1", "type": "module", "scripts": { "dev": "vite", @@ -44,6 +44,9 @@ "pnpm": { "onlyBuiltDependencies": [ "esbuild" - ] + ], + "overrides": { + "postcss@<8.5.10": ">=8.5.10" + } } } diff --git a/frontend/pnpm-lock.yaml b/frontend/pnpm-lock.yaml index 106d86f..7075b54 100644 --- a/frontend/pnpm-lock.yaml +++ b/frontend/pnpm-lock.yaml @@ -4,6 +4,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + postcss@<8.5.10: '>=8.5.10' + importers: .: @@ -1484,8 +1487,8 @@ packages: resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==} engines: {node: '>=12'} - postcss@8.5.9: - resolution: {integrity: sha512-7a70Nsot+EMX9fFU3064K/kdHWZqGVY+BADLyXc8Dfv+mTLLVl6JzJpPaCZ2kQL9gIJvKXSLMHhqdRRjwQeFtw==} + postcss@8.5.10: + resolution: {integrity: sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==} engines: {node: ^10 || ^12 || >=14} prelude-ls@1.2.1: @@ -3095,7 +3098,7 @@ snapshots: picomatch@4.0.4: {} - postcss@8.5.9: + postcss@8.5.10: dependencies: nanoid: 3.3.11 picocolors: 1.1.1 @@ -3336,7 +3339,7 @@ snapshots: esbuild: 0.25.12 fdir: 6.5.0(picomatch@4.0.4) picomatch: 4.0.4 - postcss: 8.5.9 + postcss: 8.5.10 rollup: 4.60.1 tinyglobby: 0.2.16 optionalDependencies: