Repository navigation
chore: force patched postcss and prune obsolete security overrides - #387
Conversation
The CI audit gate (`pnpm audit --audit-level=high`) failed on every open PR. postcss resolved to 8.5.16 in the lockfile and GHSA-r28c-9q8g-f849 covers <=8.5.17. It is transitive-only — reached ~100 ways through the Storybook/Vite chain and the Docusaurus webpack CSS pipeline — so nothing ever re-resolved it after the advisory published. Add a `postcss@<8.5.18` override and refresh the lockfile. pnpm settles on 8.5.21, the newest release clear of the 3-day cooldown, so no cooldown exclusion is needed for it. Also prune hardening config that no longer does anything: - The `fast-uri` cooldown exclusion carried an explicit expiry of 2026-07-22. 3.1.4 published 2026-07-19 and now clears the cooldown unaided, leaving prettier as the only exclusion — which is intentional and permanent. - The brace-expansion, fast-uri and svgo overrides are no-ops: their parents widened their own ranges, and re-resolving without them yields byte-identical versions and a clean audit. serialize-javascript and sharp stay — without them the tree drops to 6.0.2 and 0.34.5, both under high advisories. Document the pruning procedure in pnpm-workspace.yaml so dead overrides do not silently accumulate again. Closes #386 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015wkR9URhcpY6VuU1chR6mV
WalkthroughThe workspace dependency policy pins Prettier 3.9.4, adds a patched PostCSS override, retains required ChangesDependency policy
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Preview DeploymentPreview URL: https://21d99785.bestax.pages.dev |
|
@coderabbitai review The earlier run hit the per-developer review rate limit and never looked at the diff; the window has since reopened. Note Generated by Claude Code |
|
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Around line 51-55: Update the PostCSS override selector in pnpm-workspace.yaml
to target only vulnerable PostCSS 8.x versions below 8.5.18, such as >=8.0.0
<8.5.18, while preserving the >=8.5.18 <9 replacement range. Regenerate or
adjust the lockfile so the override remains focused on vulnerable 8.x consumers.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: fc6d98c0-e1d9-48ee-b538-4a4f3c5aae20
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml,!pnpm-lock.yaml
📒 Files selected for processing (1)
pnpm-workspace.yaml
A new high-severity advisory landed against brace-expansion — GHSA-mh99-v99m-4gvg, unbounded expansion length causing an out-of-memory crash — published shortly after #387 merged, turning main red. It covers <=5.0.7, and 5.0.8 is the only patched release on any major line, so all three resolved copies (1.1.16, 2.1.2, 5.0.7) are affected at once. Force `brace-expansion: '>=5.0.8'`. With no 1.x/2.x backport available this pulls those consumers across majors, which is safe here: 5.x keeps a `require` export condition so CJS consumers still resolve, its engines (node 20 || >=22) fit the repo's Node 22/24, and every consumer is dev tooling — bulma-ui ships one runtime dependency (bulma) and brace-expansion reaches only the private docs site. Verified by the full gate, which exercises eslint, jest, the builds and Storybook. 5.0.8 published 2026-07-23, inside the 3-day cooldown, so pnpm cannot reach it unaided. Add a `minimumReleaseAgeExclude` entry following the fast-uri precedent, with a dated note: the cooldown elapses 2026-07-26, after which the exclusion should be removed and the override kept. Net effect is a smaller tree — three brace-expansion copies collapse to one, and balanced-match@1.0.2 and concat-map@0.0.1 drop out entirely. Refs #386
|
🎉 This PR is included in version 3.7.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 2.0.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 5.8.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 1.0.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
2 participants
Pull Request
Description
Unblocks the Audit (high severity) CI step, which was failing on every open PR, and clears out
hardening config that has since become dead weight. Only
pnpm-workspace.yamlandpnpm-lock.yamlchange— no source, no published output.
@allxsmith/bestax-bulma)create-bestax)@allxsmith/bestax-docs)pnpm-workspace.yaml,pnpm-lock.yaml)The failure.
postcssresolved to8.5.16in the committed lockfile, and GHSA-r28c-9q8g-f849(sourceMappingURL auto-loading follows
../out of the source directory and discloses arbitrary.mapfiles) covers
<=8.5.17. It is transitive-only — reached ~100 ways through the Storybook/Vite chain and theDocusaurus webpack CSS pipeline — so nothing in the repo ever re-resolved it after the advisory published.
Every branch inherited the failure from
main.No cooldown exclusion needed this time.
postcss@8.5.18published 2026-07-12, well outside the 3-dayminimumReleaseAgewindow. With the override in place pnpm settles on8.5.21on its own — the newestrelease that clears the cooldown — so the
minimumReleaseAgeExcludelist does not grow.Pruning the last round's workaround. The
fast-uricooldown exclusion carried an explicit expiry of2026-07-22;
3.1.4published 2026-07-19 and now clears the cooldown unaided, so it is removed. That leavesprettieras the only exclusion, which is intentional and permanent.Three security overrides also turned out to be no-ops — their parent packages widened their own ranges.
Verified by re-resolving with each override removed and comparing:
brace-expansion(3 pins)fast-urisvgoserialize-javascriptsharpRemoving those five lines changes zero resolutions — the lockfile diff for that step is exactly the five
deleted
overrides:declarations in the metadata header. To keep this from silently accumulating again, thepruning procedure is now documented in
pnpm-workspace.yaml: drop an entry, re-resolve, and leave it out ifthe resolved version is unchanged and the audit stays clean.
Related Issue(s)
Closes #386
Type of Change
Checklist
itself the regression test for this class of change; a unit test is not applicable
pnpm-workspace.yamlCLAUDE.mdfiles areupdated — n/a, no command or structural changes
Verification
Run locally on the final tree:
pnpm audit --audit-level=high→ exit 0 (was exit 1)pnpm install --frozen-lockfile→ no-op, lockfile in sync for CI paritypnpm all→ green (build, typecheck, test + coverage, bundle:stats, lint, format:check, Storybook build)Additional Context
Four advisories remain below the gate threshold and are deliberately left alone, consistent with the repo's
existing posture of holding
highand above at zero:uuid@8.3.2(moderate),webpack-dev-server@5.2.5(two moderate),
body-parser@1.20.5(low). All are dev/build-time only and none are reachable frompublished package output.
chore:commit — no semantic-release version bump for any package.Generated by Claude Code
Summary by CodeRabbit