From a8a0257fc285586d8385924b95e980f84df3d4f6 Mon Sep 17 00:00:00 2001 From: Support Bot Date: Fri, 24 Jul 2026 19:58:42 +0000 Subject: [PATCH] fix(security): bump postcss pin from 8.5.12 to 8.5.23 Bumps the repo-wide postcss override/resolution from 8.5.12 to 8.5.23 to remediate GHSA-r28c-9q8g-f849 (CVSS 7.5, High). The advisory describes a path-traversal bug in PostCSS's sourceMappingURL auto-loading (lib/previous-map.js): a crafted sourceMappingURL containing ../ sequences could read arbitrary .map files from the filesystem. The fix in 8.5.18+ restricts source-map loading to the opts.from directory; 8.5.18 through 8.5.23 contain no further breaking changes. postcss is not a direct dependency of BitGoJS; it is pulled in transitively by css-loader, sanitize-html, @vue/compiler-sfc, and the web-demo app. Because the existing resolutions/overrides pin was already collapsing all four ranges (^8.2.14, ^8.2.15, ^8.3.11, ^8.5.6) to a single version, switching to 8.5.23 satisfies every range unchanged. None of BitGoJS's usages load source maps from outside opts.from, so the new restriction has no functional impact. This unblocks the "Publish @bitgo-beta" GitHub Actions workflow, which was failing at the osv-scanner "Enforce Vulnerability Severity Threshold" gate due to this advisory. Ticket: INF-2186 Session-Id: 87e939d9-34b0-414f-9c42-0dbca6398ab4 Task-Id: da7773f3-f9b6-44b0-b5df-ce432cca3a78 --- package.json | 4 ++-- yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index f3ae610cbd..7a93415c76 100644 --- a/package.json +++ b/package.json @@ -129,7 +129,7 @@ "sjcl": "npm:@bitgo/sjcl@1.0.1", "picomatch": ">=2.3.2", "fast-uri": "3.1.3", - "postcss": "8.5.12", + "postcss": "8.5.23", "@babel/plugin-transform-modules-systemjs": "7.29.4", "protobufjs": "7.6.4", "@protobufjs/fetch": "1.1.0", @@ -201,7 +201,7 @@ "sjcl": "npm:@bitgo/sjcl@1.0.1", "picomatch": ">=2.3.2", "fast-uri": "3.1.3", - "postcss": "8.5.12", + "postcss": "8.5.23", "@babel/plugin-transform-modules-systemjs": "7.29.4", "protobufjs": "7.6.4", "@protobufjs/fetch": "1.1.0", diff --git a/yarn.lock b/yarn.lock index e78d7ef1f2..99b3b4b75f 100644 --- a/yarn.lock +++ b/yarn.lock @@ -17313,10 +17313,10 @@ postcss-value-parser@^4.0.2, postcss-value-parser@^4.1.0, postcss-value-parser@^ resolved "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz" integrity sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ== -postcss@8.5.12, postcss@^8.2.14, postcss@^8.2.15, postcss@^8.3.11, postcss@^8.5.6: - version "8.5.12" - resolved "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz#cd0c0f667f7cb0521e2313234ea6e707a9ec1ddb" - integrity sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA== +postcss@8.5.23, postcss@^8.2.14, postcss@^8.2.15, postcss@^8.3.11, postcss@^8.5.6: + version "8.5.23" + resolved "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz" + integrity sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg== dependencies: nanoid "^3.3.11" picocolors "^1.1.1"