Repository navigation
chore(deps): transitively update postcss - #31436
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
package: core
thetaPC
left a comment
thetaPC
left a comment
There was a problem hiding this comment.
packages/angular-server looks missed. It's still on postcss 8.5.15, under the 8.5.23 bar that GHSA-fxqj-rqcc-2cmp sets, so its alerts stay open. Should be a plain npm update postcss case.
| "webpack": "^5.61.0", | ||
| "webpack-cli": "^4.9.2" | ||
| }, | ||
| "overrides": { |
There was a problem hiding this comment.
Good call on the override. I'd scoped ng18/ng19/ng20 as unfixable, since @angular-devkit/build-angular pins postcss exactly and the newest devkit in each major is still vulnerable (18 gives 8.4.41, 19 gives 8.5.12). Forcing ^8.5.23 clears all three, which takes three dismissals off FW-7722.
There was a problem hiding this comment.
Worth a line in the PR description: the v2 to v3 lockfile migration is most of this file's diff.
Also might be worth mentioning in the description, react-router goes 5.3.4 to 6.30.6. That's a stale lockfile catching up rather than a new bump, since package.json already declared ^6.0.0. Reads alarming in a postcss PR otherwise.
There was a problem hiding this comment.
Same v2 to v3 migration here, which accounts for the diff size.
thetaPC
left a comment
thetaPC
left a comment
There was a problem hiding this comment.
Let's get the conflict sorted out
There was a problem hiding this comment.
Worth a line in the PR description: the v2 to v3 lockfile migration is most of this file's diff.
…#31616) Issue number: resolves internal --------- ## What is the current behavior? Dependabot and `npm audit` report high and critical alerts against the lock files in `core` and `packages/*`. None of them reach users: lock files are not published, and our declared ranges already resolve to the patched versions on a fresh install. The alerts are noise that can bury a real one. ## What is the new behavior? - Updated the vulnerable packages, and the parents that pin them, within the existing ranges. - Added an override in `core` for `compression` under `serve`, since the latest `serve` pins the vulnerable version. Remove it once a `serve` release includes vercel/serve#868. - `migrate` moves to `vite` 7.3.7 rather than the latest 8.x, which would swap its test bundler for Rolldown. - Angular dev dependencies move from 22.0 to 22.2. Angular 22.2 dropped the private `contexts` field from the `ChildrenOutletContexts` typings, so `ion-router-outlet` now casts to a local type when it saves and restores tab state. The field still exists at runtime, so behavior is unchanged. - `@angular/cli` 22.2 no longer bundles its MCP server, which accounts for most of the removals in the Angular lock file. ## Does this introduce a breaking change? - [ ] Yes - [x] No ## Other information Test app and root lock files are updated in ionic-team#31617. The `postcss` 7 alerts in `core` remain: they come from `stylelint` 13 and need a `stylelint` upgrade, as noted in ionic-team#31436. --------- Co-authored-by: Brandy Smith <6577830+brandyscarney@users.noreply.github.com>
Issue number: internal
What is the current behavior?
Several dependencies throughout the repo have postcss as a dependency. While it doesn't affect users, a vulnerability in postcss causes dependabot to log high severity alerts.
What is the new behavior?
npm updatefor all other packages that inherited postcss. This has a few side effects:lockFileVersionfrom 2 to 3, which accounts for most of the diff in the package-lock files.react-routerfrom 5 to 6 in the React 18 test app package-lock.Does this introduce a breaking change?
Other information
Core uses old versions of stylelint and stylelint-order that cannot be easily updated, and these use an old postcss with the vulnerability.
Co-authored-by: @anupamme