chore(deps): transitively update postcss - #31436
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
package: core
thetaPC
left a comment
thetaPC
left a comment
There was a problem hiding this comment.
packages/angular-server looks missed. It's still on postcss 8.5.15, under the 8.5.23 bar that GHSA-fxqj-rqcc-2cmp sets, so its alerts stay open. Should be a plain npm update postcss case.
| "webpack": "^5.61.0", | ||
| "webpack-cli": "^4.9.2" | ||
| }, | ||
| "overrides": { |
There was a problem hiding this comment.
Good call on the override. I'd scoped ng18/ng19/ng20 as unfixable, since @angular-devkit/build-angular pins postcss exactly and the newest devkit in each major is still vulnerable (18 gives 8.4.41, 19 gives 8.5.12). Forcing ^8.5.23 clears all three, which takes three dismissals off FW-7722.
There was a problem hiding this comment.
Worth a line in the PR description: the v2 to v3 lockfile migration is most of this file's diff.
Also might be worth mentioning in the description, react-router goes 5.3.4 to 6.30.6. That's a stale lockfile catching up rather than a new bump, since package.json already declared ^6.0.0. Reads alarming in a postcss PR otherwise.
There was a problem hiding this comment.
Same v2 to v3 migration here, which accounts for the diff size.
| "webpack-cli": "^4.9.2" | ||
| }, | ||
| "overrides": { | ||
| "postcss": "^8.5.23" |
There was a problem hiding this comment.
Not blocking, just flagging debt: this app can't take a general npm update. It aborts with ERESOLVE over @angular/compiler@20.1.8, which is presumably why the override was needed rather than a version bump. npm install is fine and reproduces the lockfile exactly, so postcss is genuinely fixed here.
Worth its own card, since the next transitive advisory in this app will hit the same wall and need the same override workaround.
2 participants
Issue number: internal
What is the current behavior?
Several dependencies throughout the repo have postcss as a dependency. While it doesn't affect users, a vulnerability in postcss causes dependabot to log high severity alerts.
What is the new behavior?
npm updatefor all other packages that inherited postcss.Does this introduce a breaking change?
Other information
Core uses old versions of stylelint and stylelint-order that cannot be easily updated, and these use an old postcss with the vulnerability.