From bf7fd8f315001a034f3619259c9201612545edd8 Mon Sep 17 00:00:00 2001 From: Arjun Chikara Date: Mon, 27 Jul 2026 22:08:08 +0530 Subject: [PATCH] =?UTF-8?q?chore(deps):=20security=20bumps=20=E2=80=94=20p?= =?UTF-8?q?ostcss,=20shell-quote?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add npm overrides so these transitive dev deps resolve to non-vulnerable versions (durable across lockfile regeneration). Lockfile kept at v2. - postcss 8.5.6 -> 8.5.23 GHSA-6g55-p6wh-862q AXE-3900 - shell-quote 1.8.4 -> 1.10.0 GHSA-395f-4hp3-45gv AXE-3901 Both are dev/build-tooling only — axe-core declares no runtime dependencies, so neither ships in the published bundle: postcss <- @csstools/css-syntax-patches-for-csstree <- cssstyle <- jsdom shell-quote <- npm-run-all postcss pulls nanoid 3.3.11 -> 3.3.16 as its own dependency. [a11y-critical]: security-only dependency bumps in the axe-core submodule (package.json is JSON, so the impact tag is recorded in this message). Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 45 ++++++++++++++++++++++++--------------------- package.json | 4 +++- 2 files changed, 27 insertions(+), 22 deletions(-) diff --git a/package-lock.json b/package-lock.json index 923d9e06d..88364dd2f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10133,9 +10133,9 @@ } }, "node_modules/nanoid": { - "version": "3.3.11", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz", - "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==", + "version": "3.3.16", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", + "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", "dev": true, "funding": [ { @@ -10143,6 +10143,7 @@ "url": "https://github.com/sponsors/ai" } ], + "license": "MIT", "peer": true, "bin": { "nanoid": "bin/nanoid.cjs" @@ -11242,9 +11243,9 @@ } }, "node_modules/postcss": { - "version": "8.5.6", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz", - "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==", + "version": "8.5.23", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz", + "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==", "dev": true, "funding": [ { @@ -11260,9 +11261,10 @@ "url": "https://github.com/sponsors/ai" } ], + "license": "MIT", "peer": true, "dependencies": { - "nanoid": "^3.3.11", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, @@ -12204,10 +12206,11 @@ } }, "node_modules/shell-quote": { - "version": "1.8.4", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", - "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", + "version": "1.10.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz", + "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==", "dev": true, + "license": "MIT", "engines": { "node": ">= 0.4" }, @@ -21235,9 +21238,9 @@ "dev": true }, "nanoid": { - "version": "3.3.11", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz", - "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==", + "version": "3.3.16", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", + "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", "dev": true, "peer": true }, @@ -21418,7 +21421,7 @@ "minimatch": "^3.1.3", "pidtree": "^0.3.0", "read-pkg": "^3.0.0", - "shell-quote": "^1.6.1", + "shell-quote": "1.10.0", "string.prototype.padend": "^3.0.0" }, "dependencies": { @@ -22069,13 +22072,13 @@ } }, "postcss": { - "version": "8.5.6", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz", - "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==", + "version": "8.5.23", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz", + "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==", "dev": true, "peer": true, "requires": { - "nanoid": "^3.3.11", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } @@ -22794,9 +22797,9 @@ "dev": true }, "shell-quote": { - "version": "1.8.4", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", - "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", + "version": "1.10.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz", + "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==", "dev": true }, "shellwords": { diff --git a/package.json b/package.json index 8881afb15..95dede5ff 100644 --- a/package.json +++ b/package.json @@ -212,6 +212,8 @@ "brace-expansion@5": "5.0.7", "js-yaml@3": "3.15.0", "js-yaml@4": "4.3.0", - "linkify-it": "5.0.2" + "linkify-it": "5.0.2", + "postcss": "8.5.23", + "shell-quote": "1.10.0" } }