From 78989907c740574710c387a82ec49a89c0d81dc1 Mon Sep 17 00:00:00 2001 From: Sachu Shaji Abraham Date: Thu, 23 Jul 2026 22:36:15 +0530 Subject: [PATCH] fix(root): pin postcss to 8.5.12 to address CVE-2026-45623 GHSA-6g55-p6wh-862q (CVSS 7.5 HIGH): postcss <=8.5.11 arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments. Published to the GitHub Advisory DB 2026-07-23, which caused the osv-severity-gate to fail publish run #2895. All existing postcss ranges (^8.2.14..^8.5.6) admit 8.5.12, so this is a patch-level pin via root resolutions/overrides, consistent with prior security pins (e.g. fast-uri, protobufjs). --- package.json | 2 ++ yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/package.json b/package.json index 72c797967b..f3ae610cbd 100644 --- a/package.json +++ b/package.json @@ -129,6 +129,7 @@ "sjcl": "npm:@bitgo/sjcl@1.0.1", "picomatch": ">=2.3.2", "fast-uri": "3.1.3", + "postcss": "8.5.12", "@babel/plugin-transform-modules-systemjs": "7.29.4", "protobufjs": "7.6.4", "@protobufjs/fetch": "1.1.0", @@ -200,6 +201,7 @@ "sjcl": "npm:@bitgo/sjcl@1.0.1", "picomatch": ">=2.3.2", "fast-uri": "3.1.3", + "postcss": "8.5.12", "@babel/plugin-transform-modules-systemjs": "7.29.4", "protobufjs": "7.6.4", "@protobufjs/fetch": "1.1.0", diff --git a/yarn.lock b/yarn.lock index df295d9360..e78d7ef1f2 100644 --- a/yarn.lock +++ b/yarn.lock @@ -17313,10 +17313,10 @@ postcss-value-parser@^4.0.2, postcss-value-parser@^4.1.0, postcss-value-parser@^ resolved "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz" integrity sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ== -postcss@^8.2.14, postcss@^8.2.15, postcss@^8.3.11, postcss@^8.5.6: - version "8.5.10" - resolved "https://registry.npmjs.org/postcss/-/postcss-8.5.10.tgz#8992d8c30acf3f12169e7c09514a12fed7e48356" - integrity sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ== +postcss@8.5.12, postcss@^8.2.14, postcss@^8.2.15, postcss@^8.3.11, postcss@^8.5.6: + version "8.5.12" + resolved "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz#cd0c0f667f7cb0521e2313234ea6e707a9ec1ddb" + integrity sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA== dependencies: nanoid "^3.3.11" picocolors "^1.1.1"