fix: lift root postcss to 8.5.23 (Dependabot) (#23396)
## Summary Clears the root postcss alert [1851](https://github.com/twentyhq/twenty/security/dependabot/1851): **GHSA-r28c-9q8g-f849** (high) - path traversal in previous source map auto-loading (`sourceMappingURL`) leading to arbitrary `.map` file disclosure, vulnerable `<= 8.5.17`. The root lockfile carried **two** vulnerable copies, both behind exact pins with no fixed upstream release: | Copy | Pinner | Latest release still pins | |---|---|---| | 8.5.15 | `next` (8.4.31 exact) | 16.2.12 -> 8.4.31 | | 8.5.14 | `@mintlify/common` (8.5.14 exact) | 1.0.1051 -> 8.5.14 | So no parent upgrade reaches the fix. The existing `next/postcss` resolution moves **8.5.15 -> 8.5.23** and a matching **`@mintlify/common/postcss`** pin is added, placed alphabetically among the other `@mintlify/*` entries. The caret consumers (`^8.4.38`, `^8.4.47`, `^8.5.15`) dedupe onto the same version. ## Verification - The two copies **collapse into a single `postcss@8.5.23` entry**; nothing at or below 8.5.17 remains. - `yarn install --immutable` passes. - 8.5.23 published 2026-07-24, clears the 3-day npm age gate. - `//resolutions` updated with the advisory, both pinners (and their latest-version evidence) and the drop condition. The app-lockfile side of this advisory shipped separately in #23340.
This commit is contained in:
+3
-2
File diff suppressed because one or more lines are too long
@@ -39345,12 +39345,12 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"nanoid@npm:^3.3.11, nanoid@npm:^3.3.12":
|
||||
version: 3.3.12
|
||||
resolution: "nanoid@npm:3.3.12"
|
||||
"nanoid@npm:^3.3.16":
|
||||
version: 3.3.16
|
||||
resolution: "nanoid@npm:3.3.16"
|
||||
bin:
|
||||
nanoid: bin/nanoid.cjs
|
||||
checksum: 10c0/ba142b7b39e11e80c16dd74b0365d407880c87c1cf7e1480956981ae940ee36060fa5b6f092cd1e315184dd19244c657bd017d03327bd3c62247d691c5e8edfb
|
||||
checksum: 10c0/bbf2dcffe22d2b62d16de2711752070b539c0f644c7916f823ad6521986b2078cbe524f2d6240f58c46e9141ea0c7b87a029e100c0f7f175228cacaf30e41bba
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
@@ -42425,25 +42425,14 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"postcss@npm:8.5.14":
|
||||
version: 8.5.14
|
||||
resolution: "postcss@npm:8.5.14"
|
||||
"postcss@npm:8.5.23, postcss@npm:^8.4.38, postcss@npm:^8.4.47, postcss@npm:^8.5.15":
|
||||
version: 8.5.23
|
||||
resolution: "postcss@npm:8.5.23"
|
||||
dependencies:
|
||||
nanoid: "npm:^3.3.11"
|
||||
nanoid: "npm:^3.3.16"
|
||||
picocolors: "npm:^1.1.1"
|
||||
source-map-js: "npm:^1.2.1"
|
||||
checksum: 10c0/48138207cf5ef5581be1bfe2cb65ccfe0ac75e43888ba045afc8ed6043d7b56aeb3b9a9fe5b353ff554be943cd0cc15d826ccb991525159175971e5ee8ab0237
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"postcss@npm:8.5.15, postcss@npm:^8.4.38, postcss@npm:^8.4.47, postcss@npm:^8.5.15":
|
||||
version: 8.5.15
|
||||
resolution: "postcss@npm:8.5.15"
|
||||
dependencies:
|
||||
nanoid: "npm:^3.3.12"
|
||||
picocolors: "npm:^1.1.1"
|
||||
source-map-js: "npm:^1.2.1"
|
||||
checksum: 10c0/7f2e63ae22fbe43aace1bf652bd99da4e90737c64194d49e51ddc9cd0f9e51ff2861a7d734379b494deffa03a880a5c65eec70bc29ee9ebaa7136dde3eee8f31
|
||||
checksum: 10c0/ed714e635b330bb42666ecdd0c0b4f30224ded15b0b0052d6bc2b92832f2cf17d1c1141359453f96f0a84f8fbf4c405a74df187f559163b8f31131b2535455aa
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
|
||||
Reference in New Issue
Block a user