Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency postcss to v8.4.31 [security] #709

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 24, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
postcss (source) 8.4.21 -> 8.4.31 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-44270

An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.

This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.


Release Notes

postcss/postcss (postcss)

v8.4.31

Compare Source

v8.4.30

Compare Source

  • Improved source map performance (by Romain Menke).

v8.4.29

Compare Source

  • Fixed Node#source.offset (by Ido Rosenthal).
  • Fixed docs (by Christian Oliff).

v8.4.28

Compare Source

  • Fixed Root.source.end for better source map (by Romain Menke).
  • Fixed Result.root types when process() has no parser.

v8.4.27

Compare Source

  • Fixed Container clone methods types.

v8.4.26

Compare Source

  • Fixed clone methods types.

v8.4.25

Compare Source

v8.4.24

Compare Source

  • Fixed Plugin types.

v8.4.23

Compare Source

  • Fixed warnings in TypeDoc.

v8.4.22

Compare Source

  • Fixed TypeScript support with node16 (by Remco Haszing).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@webteam-app
Copy link

Demo starting at https://cn-ubuntu-com-709.demos.haus

@codecov
Copy link

codecov bot commented Oct 24, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 58.09%. Comparing base (285f964) to head (a25e72e).
Report is 14 commits behind head on main.

Current head a25e72e differs from pull request most recent head ee60f7b

Please upload reports for the commit ee60f7b to get more accurate results.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #709   +/-   ##
=======================================
  Coverage   58.09%   58.09%           
=======================================
  Files           3        3           
  Lines         105      105           
=======================================
  Hits           61       61           
  Misses         44       44           
Flag Coverage Δ
python 58.09% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from 09c7fab to 36a4197 Compare November 24, 2023 15:22
@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from 36a4197 to a25e72e Compare February 23, 2024 14:32
@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from a25e72e to d280b64 Compare April 12, 2024 14:12
@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch 3 times, most recently from 576d759 to be379df Compare May 29, 2024 17:08
@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch 2 times, most recently from cea6a48 to ee60f7b Compare June 13, 2024 04:38
@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from ee60f7b to a7d63b6 Compare August 9, 2024 11:40
@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from a7d63b6 to e8af0b0 Compare September 4, 2024 11:24
@renovate renovate bot changed the title Update dependency postcss to v8.4.31 [SECURITY] chore(deps): update dependency postcss to v8.4.31 [security] Sep 25, 2024
@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from e8af0b0 to 2682e08 Compare September 25, 2024 08:40
@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from 2682e08 to f64620c Compare October 3, 2024 08:30
@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from f64620c to 3a208bf Compare October 11, 2024 13:22
@renovate renovate bot force-pushed the renovate/npm-postcss-vulnerability branch from 3a208bf to 5c7b49f Compare November 20, 2024 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant