From 637ccad155c474208ce364116882c2fec2acefbb Mon Sep 17 00:00:00 2001 From: Chris Thomas Date: Fri, 24 Apr 2026 16:33:54 -0500 Subject: [PATCH] chore(deps): patch postcss, dompurify, protobufjs via pnpm overrides MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolves 6 open Dependabot alerts (1 critical, 5 medium) on main: - protobufjs: ^7.5.5 (new override) — GHSA-xq3m-2v4x-88gg (critical, RCE) - postcss: ^8.5.10 (new override) — GHSA-qx2v-qp2m-jg93 (XSS via unescaped ) - dompurify: ^3.4.0 (bumped from ^3.3.2) — GHSA-39q2-94rc-95cp, GHSA-v9jr-rg53-9pgp, GHSA-h7mw-gpvr-xq4m, GHSA-crv5-9vww-q3g8 (XSS / sanitizer bypasses) --- package.json | 4 +++- pnpm-lock.yaml | 38 +++++++++++++++----------------------- 2 files changed, 18 insertions(+), 24 deletions(-) diff --git a/package.json b/package.json index ae5f8b0..cf58127 100644 --- a/package.json +++ b/package.json @@ -88,7 +88,9 @@ "brace-expansion@^5": "^5.0.5", "yaml@^2": "^2.8.3", "smol-toml": "^1.6.1", - "dompurify": "^3.3.2", + "dompurify": "^3.4.0", + "postcss": "^8.5.10", + "protobufjs": "^7.5.5", "vite": "^7.3.2", "defu": "^6.1.5" } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c01a223..7d75ebb 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -14,7 +14,9 @@ overrides: brace-expansion@^5: ^5.0.5 yaml@^2: ^2.8.3 smol-toml: ^1.6.1 - dompurify: ^3.3.2 + dompurify: ^3.4.0 + postcss: ^8.5.10 + protobufjs: ^7.5.5 vite: ^7.3.2 defu: ^6.1.5 @@ -3885,8 +3887,8 @@ packages: resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==} engines: {node: '>= 4'} - dompurify@3.3.3: - resolution: {integrity: sha512-Oj6pzI2+RqBfFG+qOaOLbFXLQ90ARpcGG6UePL82bJLtdsa6CYJD7nmiU8MW9nQNOtCHV3lZ/Bzq1X0QYbBZCA==} + dompurify@3.4.1: + resolution: {integrity: sha512-JahakDAIg1gyOm7dlgWSDjV4n7Ip2PKR55NIT6jrMfIgLFgWo81vdr1/QGqWtFNRqXP9UV71oVePtjqS2ebnPw==} domutils@3.2.2: resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==} @@ -5384,7 +5386,7 @@ packages: engines: {node: '>= 18'} peerDependencies: jiti: '>=1.21.0' - postcss: '>=8.0.9' + postcss: ^8.5.10 tsx: ^4.8.1 yaml: ^2.8.3 peerDependenciesMeta: @@ -5409,10 +5411,6 @@ packages: resolution: {integrity: sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==} engines: {node: ^10 || ^12 || >=14} - postcss@8.5.8: - resolution: {integrity: sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg==} - engines: {node: ^10 || ^12 || >=14} - posthog-js@1.363.2: resolution: {integrity: sha512-4ZEWMrymlFzjgDSmh25VeJQT//2XUFbfKqEPDNUW4dxcqWiVMo1+gJFy5YhJgVYS46OAXLbMcJgmuZBCnDIgVg==} @@ -5522,8 +5520,8 @@ packages: property-information@7.1.0: resolution: {integrity: sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ==} - protobufjs@7.5.4: - resolution: {integrity: sha512-CvexbZtbov6jW2eXAvLukXjXUW1TzFaivC46BpWc/3BpcCysb5Vffu+B3XHMm8lVEuy2Mm4XGex8hBSg1yapPg==} + protobufjs@7.5.5: + resolution: {integrity: sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg==} engines: {node: '>=12.0.0'} proxy-addr@2.0.7: @@ -6176,7 +6174,7 @@ packages: peerDependencies: '@microsoft/api-extractor': ^7.36.0 '@swc/core': ^1 - postcss: ^8.4.12 + postcss: ^8.5.10 typescript: '>=4.5.0' peerDependenciesMeta: '@microsoft/api-extractor': @@ -7934,7 +7932,7 @@ snapshots: '@opentelemetry/sdk-logs': 0.208.0(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-metrics': 2.2.0(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.1) - protobufjs: 7.5.4 + protobufjs: 7.5.5 '@opentelemetry/resources@2.2.0(@opentelemetry/api@1.9.1)': dependencies: @@ -10437,7 +10435,7 @@ snapshots: dependencies: domelementtype: 2.3.0 - dompurify@3.3.3: + dompurify@3.4.1: optionalDependencies: '@types/trusted-types': 2.0.7 @@ -11831,7 +11829,7 @@ snapshots: monaco-editor@0.54.0: dependencies: - dompurify: 3.3.3 + dompurify: 3.4.1 marked: 14.0.0 monaco-languageserver-types@0.4.0: @@ -12227,12 +12225,6 @@ snapshots: picocolors: 1.1.1 source-map-js: 1.2.1 - postcss@8.5.8: - dependencies: - nanoid: 3.3.11 - picocolors: 1.1.1 - source-map-js: 1.2.1 - posthog-js@1.363.2: dependencies: '@opentelemetry/api': 1.9.1 @@ -12243,7 +12235,7 @@ snapshots: '@posthog/core': 1.24.1 '@posthog/types': 1.363.2 core-js: 3.49.0 - dompurify: 3.3.3 + dompurify: 3.4.1 fflate: 0.4.8 preact: 10.29.1 query-selector-shadow-dom: 1.0.1 @@ -12307,7 +12299,7 @@ snapshots: property-information@7.1.0: {} - protobufjs@7.5.4: + protobufjs@7.5.5: dependencies: '@protobufjs/aspromise': 1.1.2 '@protobufjs/base64': 1.1.2 @@ -12823,7 +12815,7 @@ snapshots: node-fetch: 3.3.2 open: 11.0.0 ora: 8.2.0 - postcss: 8.5.8 + postcss: 8.5.10 postcss-selector-parser: 7.1.1 prompts: 2.4.2 recast: 0.23.11