From dce0f98f3f1b1d3fb3d537c3705ff87eb2db3f9c Mon Sep 17 00:00:00 2001 From: Ben Date: Wed, 2 Sep 2026 10:09:51 -0400 Subject: [PATCH] chore(security): bump postcss-selector-parser to ^6.1.3 in datasheetsChat Closes Dependabot alert #78 (GHSA-w9m9-85wc-3x92, low). postcss-selector-parser is transitive here, so the fix is an npm `overrides` entry. The override is scoped under the two parents whose requested ranges actually resolve into the vulnerable range (postcss-nested ^6.1.1 and tailwindcss ^6.0.11); a global override was avoided because @tailwindcss/typography pins 6.0.10 exactly, which is below the vulnerable range and therefore not affected. Lockfile regenerated with `npm install --package-lock-only`; the only resolved change is postcss-selector-parser 6.1.2 -> 6.1.4. --- datasheetsChat/package-lock.json | 7 ++++--- datasheetsChat/package.json | 8 +++++++- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/datasheetsChat/package-lock.json b/datasheetsChat/package-lock.json index 85720bd..c076531 100644 --- a/datasheetsChat/package-lock.json +++ b/datasheetsChat/package-lock.json @@ -5757,9 +5757,10 @@ } }, "node_modules/postcss-selector-parser": { - "version": "6.1.2", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz", - "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==", + "version": "6.1.4", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", + "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", + "license": "MIT", "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" diff --git a/datasheetsChat/package.json b/datasheetsChat/package.json index 2a0a1fd..4d9afbd 100644 --- a/datasheetsChat/package.json +++ b/datasheetsChat/package.json @@ -43,6 +43,12 @@ "postcss": "^8.5.23", "js-yaml": "^4.3.1", "brace-expansion@^1": "^1.1.16", - "brace-expansion@^2": "^2.1.4" + "brace-expansion@^2": "^2.1.4", + "postcss-nested": { + "postcss-selector-parser": "^6.1.3" + }, + "tailwindcss": { + "postcss-selector-parser": "^6.1.3" + } } }