Conversation
Automated dependency upgrade by OrbisAI Security
|
@anupamme is attempting to deploy a commit to the Ionic Team on Vercel. A member of the Team first needs to authorize it. |
|
Flagging overlap with #31318, which also touches `packages/vue-router`'s postcss resolution. This PR targets postcss 8.5.18 (fixes GHSA-r28c-9q8g-f849). However, `main` has since moved to postcss 8.5.14 by default (no override), and there's a further postcss fix in 8.5.23 for the case where `opts.from` is unset. 8.5.18 alone wouldn't cover that. I've updated #31318 to rebase onto current `main` and pin the override to postcss 8.5.23 (chosen over the latest 8.5.26 since 8.5.24 reportedly introduced a BOM regression for some consumers), with before/after `npm ls postcss` verification in the description. To avoid landing two overlapping postcss security PRs, would it make sense to consolidate on whichever of these two you'd rather merge? Happy to close #31318 if you'd prefer to bump the target here to 8.5.23 instead, or vice versa. |
|
Thanks for the PR! This ended up being handled in #31436, so we're closing this one out. Appreciate you digging into it. |
2 participants
Summary
Upgrade postcss from 8.5.3 to 8.5.18 to fix GHSA-r28c-9q8g-f849.
Vulnerability
GHSA-r28c-9q8g-f849packages/vue-router/package-lock.json(dependency:postcss)Description: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Changes
packages/vue-router/package.jsonpackages/vue-router/package-lock.jsonBehavior Preservation
The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.
This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.
Automated security fix by OrbisAI Security