Skip to content

fix(deps): Update dependency postcss to v8.5.18 [SECURITY] #91

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
williaby wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): Update dependency postcss to v8.5.18 [SECURITY] #91

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions frontend/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion frontend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@
"eslint-plugin-react-refresh": "^0.5.0",
"globals": "^17.0.0",
"jsdom": "^29.0.0",
"postcss": "^8.5.6",
"postcss": "^8.5.18",

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package files =="
fd -a '^(package|package-lock)\.json$' . 2>/dev/null | sed "s#^$(pwd)/##" | head -50

echo
echo "== frontend/package.json postcss section =="
if [ -f frontend/package.json ]; then
  nl -ba frontend/package.json | sed -n '1,80p'
fi

echo
echo "== lockfile postcss entries =="
if [ -f frontend/package-lock.json ]; then
  rg -n '"postcss"|source-map' frontend/package-lock.json -C 2 || true
  python3 - <<'PY'
import json
p='frontend/package-lock.json'
data=json.load(open(p))
packages=data.get('packages', {})
for pkg in [p for p in packages if p.endswith('node_modules/postcss') or p=='node_modules/postcss']:
    print(pkg, '=>', packages[pkg])
PY
fi

echo
echo "== npmjs/release metadata =="
npm view postcss version dist-tags --json 2>/dev/null | sed -n '1,120p' || true

Repository: ByronWilliamsCPA/rag-processor

Length of output: 323

🌐 Web query:

PostCSS 8.5.23 source-map security hardening release notes

💡 Result:

PostCSS version 8.5.23, released on July 24, 2026, includes security hardening related to source map handling [1][2]. Specifically, this release introduces a change to prevent the loading of source map files when the 'from' option is not provided [3][2]. This change is part of ongoing efforts to address security vulnerabilities involving arbitrary file read and information disclosure via attacker-controlled 'sourceMappingURL' comments in CSS [4][5][6]. Previous versions of PostCSS would attempt to dereference and load these paths from the local filesystem by default, even when no source map was intended or explicitly configured, potentially allowing attackers to read files on the host system [4][5][6]. By requiring the 'from' option to be present for source map loading, PostCSS adds a layer of defense to limit the scenarios in which files are automatically accessed [3][2].

Citations:

🌐 Web query:

PostCSS 8.5.25 GitHub release

💡 Result:

PostCSS version 8.5.25 was released on July 29, 2026 [1][2][3][4]. This release included two specific fixes: a correction for an 8.5.17 visitor regression and a fix for list.split when handling non-string values [1].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== npm metadata =="
npm view postcss version dist-tags --json 2>/dev/null || true

echo
echo "== frontend/package.json =="
python3 - <<'PY'
from pathlib import Path
p = Path("frontend/package.json")
text = p.read_text()
for i, line in enumerate(text.splitlines(), 1):
    if "postcss" in line.lower() or i <= 80:
        print(f"{i}: {line}")
PY

echo
echo "== frontend/package-lock.json postcss entries =="
python3 - <<'PY'
import json
from pathlib import Path
p = Path("frontend/package-lock.json")
data = json.loads(p.read_text())
for name, entry in data.get("packages", {}).items():
    if name == "node_modules/postcss" or name.endswith("/node_modules/postcss"):
        print(f"{name}:")
        for k, v in entry.items():
            if k in ("version", "resolved", "integrity", "dependencies", "dev"):
                print(f"  {k}: {v}")
PY

echo
echo "== semantic comparison =="
python3 - <<'PY'
import re
locked = Path("frontend/package-lock.json").read_text()
m = re.search(r'"node_modules/postcss":\s*\{[^"]*"version"\s*:\s*"([^"]+)"', locked)
manifest = Path("frontend/package.json").read_text()
match = re.search(r'"postcss"\s*:\s*"([^"]+)"', manifest)
print(f"locked_version={m.group(1) if m else None}")
print(f"manifest_range={match.group(1) if match else None}")
PY

Repository: ByronWilliamsCPA/rag-processor

Length of output: 2703

Update the locked PostCSS version.

frontend/package-lock.json pins PostCSS to 8.5.18, so installs from the lockfile do not get PostCSS 8.5.23 source-map hardening. Regenerate the lockfile to resolve PostCSS to the latest approved patch version.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/package.json` at line 47, Update the PostCSS dependency from 8.5.18
to the approved 8.5.23 version in package metadata, then regenerate the lockfile
so its resolved PostCSS entry and integrity data match 8.5.23.

"prettier": "^3.4.2",
"tailwindcss": "^4.1.18",
"typescript": "~6.0.0",
Expand Down
Loading