chore(deps): transitively update postcss - #31436
OS-jacobbell wants to merge 6 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
package: core
thetaPC
left a comment
thetaPC
left a comment
There was a problem hiding this comment.
packages/angular-server looks missed. It's still on postcss 8.5.15, under the 8.5.23 bar that GHSA-fxqj-rqcc-2cmp sets, so its alerts stay open. Should be a plain npm update postcss case.
| "webpack": "^5.61.0", | ||
| "webpack-cli": "^4.9.2" | ||
| }, | ||
| "overrides": { |
There was a problem hiding this comment.
Good call on the override. I'd scoped ng18/ng19/ng20 as unfixable, since @angular-devkit/build-angular pins postcss exactly and the newest devkit in each major is still vulnerable (18 gives 8.4.41, 19 gives 8.5.12). Forcing ^8.5.23 clears all three, which takes three dismissals off FW-7722.
There was a problem hiding this comment.
Worth a line in the PR description: the v2 to v3 lockfile migration is most of this file's diff.
Also might be worth mentioning in the description, react-router goes 5.3.4 to 6.30.6. That's a stale lockfile catching up rather than a new bump, since package.json already declared ^6.0.0. Reads alarming in a postcss PR otherwise.
There was a problem hiding this comment.
Same v2 to v3 migration here, which accounts for the diff size.
thetaPC
left a comment
thetaPC
left a comment
There was a problem hiding this comment.
Let's get the conflict sorted out
There was a problem hiding this comment.
Worth a line in the PR description: the v2 to v3 lockfile migration is most of this file's diff.
2 participants
Issue number: internal
What is the current behavior?
Several dependencies throughout the repo have postcss as a dependency. While it doesn't affect users, a vulnerability in postcss causes dependabot to log high severity alerts.
What is the new behavior?
npm updatefor all other packages that inherited postcss. This has a few side effects:lockFileVersionfrom 2 to 3, which accounts for most of the diff in the package-lock files.react-routerfrom 5 to 6 in the React 18 test app package-lock.Does this introduce a breaking change?
Other information
Core uses old versions of stylelint and stylelint-order that cannot be easily updated, and these use an old postcss with the vulnerability.