From 2f34ba578d93c200858159b5fb4fbcd3cbabb26e Mon Sep 17 00:00:00 2001 From: Juan Denis Date: Sun, 26 Jul 2026 12:07:14 -0400 Subject: [PATCH] fix(deps): unpin postcss override so security patches can resolve The exact `overrides.postcss: "8.5.16"` pin was the sole constraint holding postcss at a vulnerable version -- vite@8.1.4 (the only dependent) already declares `postcss: ^8.5.16`, so the override was redundant. It also made Dependabot fail with `security_update_not_possible`, reporting the pin back as though vite required it. Removing it resolves postcss to 8.5.23, above the 8.5.18 patched floor for GHSA-r28c-9q8g-f849 (path traversal in previous-source-map auto-loading). Co-Authored-By: Claude Opus 5 (1M context) --- frontend/package-lock.json | 8 ++++---- frontend/package.json | 1 - 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index d439fd1e..98bca9a0 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -5465,9 +5465,9 @@ } }, "node_modules/postcss": { - "version": "8.5.16", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz", - "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==", + "version": "8.5.23", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz", + "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==", "dev": true, "funding": [ { @@ -5485,7 +5485,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.12", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, diff --git a/frontend/package.json b/frontend/package.json index 4cdd86c9..d94e8997 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -64,7 +64,6 @@ "overrides": { "lodash": "4.18.1", "js-yaml": "4.3.0", - "postcss": "8.5.16", "@babel/core": "7.29.7", "ws": "8.21.0", "engine.io-client": "6.6.6"