From 7e0564132311a6c7bc4729f05131f58ddeba4cfb Mon Sep 17 00:00:00 2001 From: Ben Date: Wed, 2 Sep 2026 10:09:20 -0400 Subject: [PATCH] chore(security): bump postcss-selector-parser to >=6.1.3 (GHSA-w9m9-85wc-3x92) Adds an npm `overrides` entry pinning postcss-selector-parser to ^6.1.3, resolving it 6.1.2 -> 6.1.4 and out of the vulnerable range (>=6.1.0 <6.1.3). The package is a transitive dev-scope dependency (tailwindcss, postcss-nested), so a direct bump is not possible. Both parents declare ^6.1.x, so a global override satisfies them and no scoped override is needed. Closes Dependabot alert #73 / GHSA-w9m9-85wc-3x92. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 4 +++- package.json | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index e65bea3..752c94c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4132,7 +4132,9 @@ } }, "node_modules/postcss-selector-parser": { - "version": "6.1.2", + "version": "6.1.4", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", + "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index 2e1bb75..8bd88b3 100644 --- a/package.json +++ b/package.json @@ -31,6 +31,7 @@ "js-yaml": "^4.3.1", "nanoid": "^3.3.18", "postcss": "$postcss", - "sharp": "^0.35.0" + "sharp": "^0.35.0", + "postcss-selector-parser": "^6.1.3" } }