deps(canvas): bump postcss 8.5.9 → 8.5.12 (GHSA-qx2v-qp2m-jg93, medium) - #2173
Merged
HongmingWang-Rabbit merged 2 commits intoApr 27, 2026
Merged
Conversation
Closes the medium-severity dependabot alert on canvas/package-lock.json. Upstream advisory GHSA-qx2v-qp2m-jg93: "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output" — fixed in 8.5.10. We pull 8.5.12 since it's already published in the ^8.5.10 line. package.json's caret range bumps from ^8.4.0 to ^8.5.12 — wider floor prevents a future install from re-pinning below the safe version. The 8.x major-line constraint is preserved, so no breaking-change risk. Verification: full canvas vitest suite passes (1148/1148 across 78 files). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
requested a review
from hongmingwang-moleculeai
as a code owner
April 27, 2026 12:59
HongmingWang-Rabbit
enabled auto-merge
April 27, 2026 12:59
The first commit on this branch left the lockfile inconsistent for Node 20's npm 10: npm error \`npm ci\` can only install packages when your package.json and package-lock.json are in sync. Please update your lock file... npm error Missing: @emnapi/runtime@1.10.0 from lock file npm error Missing: @emnapi/core@1.10.0 from lock file Root cause: my local install ran on Node 24 / npm 11, which doesn't write peer-optional transitive entries (@img/sharp-* declares @emnapi/runtime as peerOptional). The Canvas tabs E2E job uses Node 20 / npm 10, which DOES expect those entries and rejected the lockfile with EUSAGE. Regenerated the lockfile under Node 20.19.4 (matches the lowest CI node version, lockfile is forward-compatible with 22 and 24). 6 new @emnapi/* entries added; postcss stays at 8.5.12 (the original goal of this branch). Verification: - \`nvm use 20 && npm ci\` clean - 1148/1148 vitest pass under Node 20 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
…check via run_id parsing' (#2173) from fix/2163-cr2-live-fire-freshness into main
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the medium-severity dependabot alert on
canvas/package-lock.json.</style>in CSS Stringify Output< 8.5.10Change
The wider package.json floor (
^8.5.12) prevents a futurenpm installfrom re-pinning below the safe version. The 8.x major constraint is preserved, so no breaking-change risk.Verification
npx vitest run— 1148/1148 tests pass across 78 files🤖 Generated with Claude Code