New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency postcss to v8.4.31 [security] #280

Open

renovate wants to merge 1 commit into main from renovate/npm-postcss-vulnerability

Contributor

renovate bot commented Oct 8, 2023 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
postcss (source)	`8.4.5` -> `8.4.31`

GitHub Vulnerability Alerts

CVE-2023-44270

An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.

This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.

Release Notes

postcss/postcss (postcss)

`v8.4.31`

Fixed \r parsing to fix CVE-2023-44270.

`v8.4.30`

Improved source map performance (by Romain Menke).

`v8.4.29`

Fixed Node#source.offset (by Ido Rosenthal).
Fixed docs (by Christian Oliff).

`v8.4.28`

Fixed Root.source.end for better source map (by Romain Menke).
Fixed Result.root types when process() has no parser.

`v8.4.27`

Fixed Container clone methods types.

`v8.4.26`

Fixed clone methods types.

`v8.4.25`

Improve stringify performance (by Romain Menke).
Fixed docs (by @vikaskaliramna07).

`v8.4.24`

Fixed Plugin types.

`v8.4.23`

Fixed warnings in TypeDoc.

`v8.4.22`

Fixed TypeScript support with node16 (by Remco Haszing).

`v8.4.21`

Fixed Input#error types (by Aleks Hudochenkov).

`v8.4.20`

Fixed source map generation for childless at-rules like @layer.

`v8.4.19`

Fixed whitespace preserving after AST transformations (by Romain Menke).

`v8.4.18`

Fixed an error on absolute: true with empty sourceContent (by Rene Haas).

`v8.4.17`

Fixed Node.before() unexpected behavior (by Romain Menke).
Added TOC to docs (by Mikhail Dedov).

`v8.4.16`

Fixed Root AST migration.

`v8.4.15`

Fixed AST normalization after using custom parser with old PostCSS AST.

`v8.4.14`

Print “old plugin API” warning only if plugin was used (by @zardoy).

`v8.4.13`

Fixed append() error after using .parent (by Jordan Pittman).

`v8.4.12`

Fixed package.funding to have same value between all PostCSS packages.

`v8.4.11`

Fixed Declaration#raws.value type.

`v8.4.10`

Fixed package.funding URL format.

`v8.4.9`

Fixed package.funding (by Álvaro Mondéjar).

`v8.4.8`

Fixed end position in empty Custom Properties.

`v8.4.7`

Fixed Node#warn() type (by Masafumi Koba).
Fixed comment removal in values after ,.

`v8.4.6`

Prevented comment removing when it change meaning of CSS.
Fixed parsing space in last semicolon-less CSS Custom Properties.
Fixed comment cleaning in CSS Custom Properties with space.
Fixed throwing an error on .root access for plugin-less case.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

webteam-app commented Oct 8, 2023

Demo starting at https://netplan-io-280.demos.haus

codecov bot commented Oct 8, 2023 •

edited

Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.43%. Comparing base (c3f513f) to head (1a27d55).
Report is 9 commits behind head on main.

❗ Current head 1a27d55 differs from pull request most recent head 89d973c

Please upload reports for the commit 89d973c to get more accurate results.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #280   +/-   ##
=======================================
  Coverage   80.43%   80.43%           
=======================================
  Files           2        2           
  Lines          46       46           
=======================================
  Hits           37       37           
  Misses          9        9

Flag	Coverage Δ
python	`80.43% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

renovate bot force-pushed the renovate/npm-postcss-vulnerability branch 2 times, most recently from 32f90a6 to 89d973c Compare

June 26, 2024 15:14

renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from 89d973c to 83d6568 Compare

August 9, 2024 08:07

renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from 83d6568 to 9947353 Compare

October 15, 2024 03:54


          chore(deps): update dependency postcss to v8.4.31 [security]

1a4f319

renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from 9947353 to 1a4f319 Compare

October 16, 2024 03:33

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet