From a9bba193d831900d9abf74800628335a7f5c5902 Mon Sep 17 00:00:00 2001 From: Taylor Bantle Date: Tue, 6 Oct 2026 14:50:35 -0700 Subject: [PATCH] security: pin postcss-selector-parser to 7.1.6 cssnano's postcss-calc pulled a 6.x copy alongside the 7.x one the @csstools plugins use. Everything now resolves to the single patched release. The other two open alerts have no upstream fix: http-cache-semantics (via node-gyp, from fsevents and @parcel/watcher) and sprintf-js (via js-yaml 3 and argparse 1, from jest's coverage config loader) both report no patched version. Neither ships in the published packages. Co-Authored-By: Claude Opus 5 (1M context) --- package.json | 5 +++++ yarn.lock | 12 +----------- 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/package.json b/package.json index d880e06b..7473133e 100644 --- a/package.json +++ b/package.json @@ -60,6 +60,11 @@ }, "resolutions": { "@emotion/react": "11.14.0", + "postcss-selector-parser@npm:^6.0.11": "7.1.6", + "postcss-selector-parser@npm:^6.0.2": "7.1.6", + "postcss-selector-parser@npm:^6.0.4": "7.1.6", + "postcss-selector-parser@npm:^6.0.5": "7.1.6", + "postcss-selector-parser@npm:^6.0.9": "7.1.6", "react": "19.3.0", "react-dom": "19.3.0", "tar": "7.5.22", diff --git a/yarn.lock b/yarn.lock index 991d3daf..94166297 100644 --- a/yarn.lock +++ b/yarn.lock @@ -16495,17 +16495,7 @@ __metadata: languageName: node linkType: hard -"postcss-selector-parser@npm:^6.0.11, postcss-selector-parser@npm:^6.0.2, postcss-selector-parser@npm:^6.0.4, postcss-selector-parser@npm:^6.0.5, postcss-selector-parser@npm:^6.0.9": - version: 6.1.4 - resolution: "postcss-selector-parser@npm:6.1.4" - dependencies: - cssesc: "npm:^3.0.0" - util-deprecate: "npm:^1.0.2" - checksum: 10c0/996f3290dee08ecb073d5f396d1134e619494cfd83140aec07a29618ee1e76d370769a8959d4c0cfefb24aa96dcffa4e7c4937dd881e03b735d50cba959ceb19 - languageName: node - linkType: hard - -"postcss-selector-parser@npm:^7.0.0, postcss-selector-parser@npm:^7.1.1, postcss-selector-parser@npm:^7.1.4": +"postcss-selector-parser@npm:7.1.6, postcss-selector-parser@npm:^7.0.0, postcss-selector-parser@npm:^7.1.1, postcss-selector-parser@npm:^7.1.4": version: 7.1.6 resolution: "postcss-selector-parser@npm:7.1.6" dependencies: