From ff38b2d1fe8744ec3038ad0181e11fe7b242524a Mon Sep 17 00:00:00 2001 From: Geph Date: Fri, 14 Aug 2026 14:54:58 -0600 Subject: [PATCH] Bump postcss to >=8.5.23 to fix source map path traversal CVEs. Override the transitive postcss pulled in by vite/vitest so Dependabot alerts #146 and #147 are resolved. Co-authored-by: Cursor --- package-lock.json | 14 +++++++------- package.json | 3 +++ 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/package-lock.json b/package-lock.json index cbb208c..57dce42 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2875,9 +2875,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.12", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz", - "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ { @@ -3080,9 +3080,9 @@ } }, "node_modules/postcss": { - "version": "8.5.15", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz", - "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==", + "version": "8.5.26", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz", + "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==", "dev": true, "funding": [ { @@ -3100,7 +3100,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.12", + "nanoid": "^3.3.17", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, diff --git a/package.json b/package.json index a6ae251..ea7b623 100644 --- a/package.json +++ b/package.json @@ -28,5 +28,8 @@ "jsdom": "^26.0.0", "vite": "^8.0.16", "vitest": "^4.1.9" + }, + "overrides": { + "postcss": ">=8.5.23" } }