Upgrades postcss (npm) from 8.4.26 to 8.5.23, which fixes these known vulnerabilities:
| Advisory | Severity | Affected | Fixed in | Summary |
|---|---|---|---|---|
| GHSA-6g55-p6wh-862q | high | 8.4.26 | 8.5.12 | PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments |
| GHSA-7fh5-64p2-3v2j | medium | 8.4.26 | 8.4.31 | PostCSS line return parsing error |
| GHSA-fxqj-rqcc-2cmp | medium | 8.4.26 | 8.5.23 | PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset |
| GHSA-qx2v-qp2m-jg93 | medium | 8.4.26 | 8.5.10 | PostCSS has XSS via Unescaped in its CSS Stringify Output |
| GHSA-r28c-9q8g-f849 | high | 8.4.26 | 8.5.18 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
Lockfiles changed: src/package-lock.json.
Only the version changes. This pull request lands through this branch's required checks like any other. If they fail because code has to change, g1t closes it and puts g1t on an issue to make the change.
Opened by g1t's security updates. Turn them off for this project on its Security page.