From 17ee73e1e332ee87609e9665f408e5886c14588f Mon Sep 17 00:00:00 2001 From: Claude Code Date: Mon, 12 Oct 2026 10:05:55 +0200 Subject: [PATCH 1/2] deps(apps/web): bump postcss ^8.5.15 -> ^8.5.23 (PR 103b) The direct postcss range in apps/web/package.json was ^8.5.15, which kept pnpm's resolver at 8.5.15 for the wider dep graph even after PR #103 transitively bumped postcss in some sub-trees. Bumping the direct range to ^8.5.23 lifts resolution to 8.5.29 and clears all 10 postcss Dependabot alerts (4 distinct GHSAs). - apps/web/package.json: postcss ^8.5.15 -> ^8.5.23 - pnpm-lock.yaml: regenerated, postcss resolves to 8.5.29 Validated locally: - pnpm install --no-frozen-lockfile - pnpm build (turbo: 2 successful) - pnpm --filter errors test (146/146) apps/web/package-lock.json is not regenerated here; it is a historical artifact and requires clearing apps/web/node_modules first to avoid pnpm/npm cross-tooling breakage. Documented as follow-up in PR #105. --- .changeset/fix-dep-postcss-direct.md | 24 +++++++++++++++++++++ apps/web/package.json | 2 +- pnpm-lock.yaml | 31 ++++++++++++++++++++-------- 3 files changed, 47 insertions(+), 10 deletions(-) create mode 100644 .changeset/fix-dep-postcss-direct.md diff --git a/.changeset/fix-dep-postcss-direct.md b/.changeset/fix-dep-postcss-direct.md new file mode 100644 index 0000000..e05d779 --- /dev/null +++ b/.changeset/fix-dep-postcss-direct.md @@ -0,0 +1,24 @@ +--- +'@deessejs/errors': patch +--- + +deps(apps/web): bump direct `postcss` from `^8.5.15` to `^8.5.23` to clear the remaining 10 postcss Dependabot alerts. + +PR #103 (vitest + tailwindcss) lifted `postcss` to a patched version transitively in some dep chains, but the direct dependency in `apps/web/package.json` was still pinned at `^8.5.15` and pnpm continued to resolve the wider dep graph to 8.5.15 because of the direct range floor. This PR raises the direct range to `^8.5.23`, which is the lowest version that contains patches for every currently-open postcss advisory: + +- GHSA-6g55-p6wh-862q (patched in 8.5.12) +- GHSA-fxqj-rqcc-2cmp (patched in 8.5.23) +- GHSA-qx2v-qp2m-jg93 (patched in 8.5.10) +- GHSA-r28c-9q8g-f849 (patched in 8.5.18) + +pnpm-lock.yaml now resolves `postcss` to `8.5.29` (current `^8.5.23` latest), which clears all 4 distinct postcss GHSA IDs across the 10 alerts. + +Validated locally: + +- `pnpm install --no-frozen-lockfile` (postinstall passes) +- `pnpm build` (turbo: 2 successful) +- `pnpm --filter errors test` (146/146) + +The stale 8.4.31 version, hoisted by `next@16.x.x` itself, is unaffected by this PR (it is below 8.5.10 and is not the version Dependabot reports). + +This PR is intentionally scoped to `pnpm-lock.yaml` and `apps/web/package.json`. The `apps/web/package-lock.json` lockfile is a separate artifact committed in the first commit of the repository and is not regenerated by `pnpm install`; it is read by no CI job but may be read by developers running `npm install` locally. Regenerating it requires deleting `apps/web/node_modules` to clear pnpm hoisting residue, running `npm install --package-lock-only`, then running `pnpm install` again to restore the hoisted state. That scope is out of bounds for this PR and is documented as a follow-up in PR #105. diff --git a/apps/web/package.json b/apps/web/package.json index ad8bb2f..5443566 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -36,7 +36,7 @@ "@types/react-dom": "^19.2.3", "@vitejs/plugin-react": "^6.0.5", "happy-dom": "^20.11.2", - "postcss": "^8.5.15", + "postcss": "^8.5.23", "tailwindcss": "^4.3.0", "typescript": "^6.0.3", "vitest": "^4.1.10" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f6e4245..638a408 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -89,8 +89,8 @@ importers: specifier: ^20.11.2 version: 20.14.5 postcss: - specifier: ^8.5.15 - version: 8.5.15 + specifier: ^8.5.23 + version: 8.5.29 tailwindcss: specifier: ^4.3.0 version: 4.3.0 @@ -2552,6 +2552,11 @@ packages: engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true + nanoid@3.3.20: + resolution: {integrity: sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==} + engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} + hasBin: true + next-themes@0.4.6: resolution: {integrity: sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA==} peerDependencies: @@ -2684,8 +2689,8 @@ packages: resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==} engines: {node: ^10 || ^12 || >=14} - postcss@8.5.15: - resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} + postcss@8.5.29: + resolution: {integrity: sha512-49cGhUbXj8Qenv0iTMxA1cFBzxXoctpC9Ujd77t1WcbJIr6nF/eI7g/8MgxrYldFRuAXvja7xQRwavoW7kgrxQ==} engines: {node: ^10 || ^12 || >=14} prettier@2.8.8: @@ -2876,6 +2881,10 @@ packages: resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} engines: {node: '>=0.10.0'} + source-map-js@1.2.2: + resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} + engines: {node: '>=0.10.0'} + source-map@0.7.6: resolution: {integrity: sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==} engines: {node: '>= 12'} @@ -4373,7 +4382,7 @@ snapshots: '@alloc/quick-lru': 5.2.0 '@tailwindcss/node': 4.3.0 '@tailwindcss/oxide': 4.3.0 - postcss: 8.5.15 + postcss: 8.5.29 tailwindcss: 4.3.0 '@turbo/darwin-64@2.9.15': @@ -5695,6 +5704,8 @@ snapshots: nanoid@3.3.12: {} + nanoid@3.3.20: {} + next-themes@0.4.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6): dependencies: react: 19.2.6 @@ -5842,11 +5853,11 @@ snapshots: picocolors: 1.1.1 source-map-js: 1.2.1 - postcss@8.5.15: + postcss@8.5.29: dependencies: - nanoid: 3.3.12 + nanoid: 3.3.20 picocolors: 1.1.1 - source-map-js: 1.2.1 + source-map-js: 1.2.2 prettier@2.8.8: {} @@ -6117,6 +6128,8 @@ snapshots: source-map-js@1.2.1: {} + source-map-js@1.2.2: {} + source-map@0.7.6: {} space-separated-tokens@2.0.2: {} @@ -6301,7 +6314,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.4 - postcss: 8.5.15 + postcss: 8.5.29 rolldown: 1.0.2 tinyglobby: 0.2.16 optionalDependencies: From d1bd65919382cc74a6978f486a583af4c89048bb Mon Sep 17 00:00:00 2001 From: Marty Date: Mon, 12 Oct 2026 10:46:46 +0200 Subject: [PATCH 2/2] docs(changeset): correct the mechanism behind the postcss bump The previous wording said the direct `^8.5.15` range was the binding constraint. That was wrong: caret semver already permits 8.5.29, and no peer dependency was blocking the resolution. The real reason the lockfile still pinned vulnerable postcss versions was that it was a stale snapshot from the original commit; pnpm re-uses locked versions until the lockfile is regenerated. The regen alone would have cleared the alerts; this PR additionally raises the direct range to make the manifest explicit. Also drops the outdated follow-up note that pointed at PR #105, since PR #110 is the real cleanup for the npm lockfile. --- .changeset/fix-dep-postcss-direct.md | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/.changeset/fix-dep-postcss-direct.md b/.changeset/fix-dep-postcss-direct.md index e05d779..ba79032 100644 --- a/.changeset/fix-dep-postcss-direct.md +++ b/.changeset/fix-dep-postcss-direct.md @@ -4,21 +4,27 @@ deps(apps/web): bump direct `postcss` from `^8.5.15` to `^8.5.23` to clear the remaining 10 postcss Dependabot alerts. -PR #103 (vitest + tailwindcss) lifted `postcss` to a patched version transitively in some dep chains, but the direct dependency in `apps/web/package.json` was still pinned at `^8.5.15` and pnpm continued to resolve the wider dep graph to 8.5.15 because of the direct range floor. This PR raises the direct range to `^8.5.23`, which is the lowest version that contains patches for every currently-open postcss advisory: +## Mechanism + +The caret range `^8.5.15` was not the binding constraint. Caret semver already permits any `8.5.x >= 8.5.15`, including the patched `8.5.29`; no peer dependency was forcing the resolution to a vulnerable version. The actual reason `pnpm-lock.yaml` still pinned vulnerable postcss versions was that the lockfile was a stale snapshot from the original commit, and pnpm re-uses locked versions until the lockfile is regenerated. + +`pnpm install --no-frozen-lockfile` in this PR re-resolved the graph and pnpm picked the highest version satisfying every constraint — `8.5.29`. The lockfile regen alone would have closed the alerts. This PR additionally raises the direct range to `^8.5.23` so the manifest is explicit about the floor we want, and to keep the lockfile in step if a future contributor runs `pnpm install --frozen-lockfile`. + +## Advisories cleared (4 distinct GHSAs, 10 alerts) - GHSA-6g55-p6wh-862q (patched in 8.5.12) - GHSA-fxqj-rqcc-2cmp (patched in 8.5.23) - GHSA-qx2v-qp2m-jg93 (patched in 8.5.10) - GHSA-r28c-9q8g-f849 (patched in 8.5.18) -pnpm-lock.yaml now resolves `postcss` to `8.5.29` (current `^8.5.23` latest), which clears all 4 distinct postcss GHSA IDs across the 10 alerts. +The transitive `postcss@8.4.31` hoisted by `next@16.x.x` is below 8.5.10 and not in the Dependabot view; it is not reported as an alert. + +## Scope -Validated locally: +This PR touches `pnpm-lock.yaml` and `apps/web/package.json` only. The companion cleanup of the vestigial `apps/web/package-lock.json` (an npm lockfile that no CI step reads, and which is a permanent source of duplicate Dependabot noise) lives in PR #110; that removal prevents the same class of drift from recurring in future cleanup rounds. + +## Validation - `pnpm install --no-frozen-lockfile` (postinstall passes) - `pnpm build` (turbo: 2 successful) - `pnpm --filter errors test` (146/146) - -The stale 8.4.31 version, hoisted by `next@16.x.x` itself, is unaffected by this PR (it is below 8.5.10 and is not the version Dependabot reports). - -This PR is intentionally scoped to `pnpm-lock.yaml` and `apps/web/package.json`. The `apps/web/package-lock.json` lockfile is a separate artifact committed in the first commit of the repository and is not regenerated by `pnpm install`; it is read by no CI job but may be read by developers running `npm install` locally. Regenerating it requires deleting `apps/web/node_modules` to clear pnpm hoisting residue, running `npm install --package-lock-only`, then running `pnpm install` again to restore the hoisted state. That scope is out of bounds for this PR and is documented as a follow-up in PR #105.