From e0bb33619435d8567af465532a72af8359e4ce82 Mon Sep 17 00:00:00 2001 From: Eric Seidel Date: Fri, 23 Oct 2026 15:01:19 -0700 Subject: [PATCH 1/3] chore(deps): bump DOMPurify and postcss-selector-parser for security advisories Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 12 ++++++------ package.json | 5 +++-- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index 41a7f8cc..9b0d98b1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6704,9 +6704,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.16", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz", - "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==", + "version": "3.4.17", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz", + "integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -10602,9 +10602,9 @@ } }, "node_modules/postcss-selector-parser": { - "version": "6.1.4", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", - "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", + "version": "7.1.7", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.7.tgz", + "integrity": "sha512-wWBro/7hJ40ye6TPiXkUQoXKCw23xSsjriUvqd7Uls9Sso3oLiON1flc18cCdnjgCRXw4fBVqUJJeOdDTh3P3g==", "license": "MIT", "dependencies": { "cssesc": "^3.0.0", diff --git a/package.json b/package.json index 9454e6f8..0b2fad43 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "name": "shorebird-docs", "type": "module", "version": "0.0.1", - "//": "typescript pinned to 6.x: TypeScript 7.0 (Go-based 'Project Corsa') removed the JS API (ts.sys), breaking twoslash (a dep of starlight-theme-nova) and @astrojs/check. js-yaml pinned to 4.x: v5 is ESM-only with no default export, which breaks astro's prerender (static-paths.js imports its default export). mermaid pinned to 11.x: astro-mermaid@2 supports mermaid 10/11 only, and mermaid 12 switches the default layout to ELK, re-laying out existing diagrams. Dependabot ignores major updates for all three; re-evaluate when upstream compatibility is added. @emnapi/core and @emnapi/runtime are listed directly because @astrojs/check needs them through @napi-rs/wasm-runtime, which only declares them as peers; with legacy-peer-deps they are otherwise left out on newer npm, and astro check then skips type checking and still exits 0. overrides: satori pins fflate to exactly 0.7.3 and tw-to-css pins postcss to exactly 8.4.31, and mermaid 11 requires KaTeX ^0.16.47, all below their security fixes; remove each override once the pinning package allows a patched version (for KaTeX, mermaid 12.2.0 and later allow ^0.18.0).", + "//": "typescript pinned to 6.x: TypeScript 7.0 (Go-based 'Project Corsa') removed the JS API (ts.sys), breaking twoslash (a dep of starlight-theme-nova) and @astrojs/check. js-yaml pinned to 4.x: v5 is ESM-only with no default export, which breaks astro's prerender (static-paths.js imports its default export). mermaid pinned to 11.x: astro-mermaid@2 supports mermaid 10/11 only, and mermaid 12 switches the default layout to ELK, re-laying out existing diagrams. Dependabot ignores major updates for all three; re-evaluate when upstream compatibility is added. @emnapi/core and @emnapi/runtime are listed directly because @astrojs/check needs them through @napi-rs/wasm-runtime, which only declares them as peers; with legacy-peer-deps they are otherwise left out on newer npm, and astro check then skips type checking and still exits 0. overrides: satori pins fflate to exactly 0.7.3 and tw-to-css pins postcss to exactly 8.4.31, and mermaid 11 requires KaTeX ^0.16.47, all below their security fixes, and tw-to-css pulls in tailwindcss 3, whose postcss-selector-parser ^6 is below its fix (7.1.6; tw-to-css OG images render byte-identically on 7.x); remove each override once the pinning package allows a patched version (for KaTeX, mermaid 12.2.0 and later allow ^0.18.0).", "scripts": { "dev": "astro dev", "start": "astro dev", @@ -60,7 +60,8 @@ "overrides": { "fflate": "^0.7.5", "postcss": "^8.5.23", - "katex": "^0.18.10" + "katex": "^0.18.10", + "postcss-selector-parser": "^7.1.6" }, "lavamoat": { "allowScripts": { From 5db1cd7202a38ef90e2a8e36479e83e03daa7de8 Mon Sep 17 00:00:00 2001 From: Eric Seidel Date: Fri, 23 Oct 2026 15:09:14 -0700 Subject: [PATCH 2/3] Drop the postcss-selector-parser override tw-to-css bundles its own tailwind and postcss-selector-parser, so the override only replaced a copy that is never loaded. Dismiss the alert as not used instead of carrying an override that only quiets the audit. Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 6 +++--- package.json | 5 ++--- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 9b0d98b1..c3339a6a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10602,9 +10602,9 @@ } }, "node_modules/postcss-selector-parser": { - "version": "7.1.7", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.7.tgz", - "integrity": "sha512-wWBro/7hJ40ye6TPiXkUQoXKCw23xSsjriUvqd7Uls9Sso3oLiON1flc18cCdnjgCRXw4fBVqUJJeOdDTh3P3g==", + "version": "6.1.4", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", + "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", "license": "MIT", "dependencies": { "cssesc": "^3.0.0", diff --git a/package.json b/package.json index 0b2fad43..9454e6f8 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "name": "shorebird-docs", "type": "module", "version": "0.0.1", - "//": "typescript pinned to 6.x: TypeScript 7.0 (Go-based 'Project Corsa') removed the JS API (ts.sys), breaking twoslash (a dep of starlight-theme-nova) and @astrojs/check. js-yaml pinned to 4.x: v5 is ESM-only with no default export, which breaks astro's prerender (static-paths.js imports its default export). mermaid pinned to 11.x: astro-mermaid@2 supports mermaid 10/11 only, and mermaid 12 switches the default layout to ELK, re-laying out existing diagrams. Dependabot ignores major updates for all three; re-evaluate when upstream compatibility is added. @emnapi/core and @emnapi/runtime are listed directly because @astrojs/check needs them through @napi-rs/wasm-runtime, which only declares them as peers; with legacy-peer-deps they are otherwise left out on newer npm, and astro check then skips type checking and still exits 0. overrides: satori pins fflate to exactly 0.7.3 and tw-to-css pins postcss to exactly 8.4.31, and mermaid 11 requires KaTeX ^0.16.47, all below their security fixes, and tw-to-css pulls in tailwindcss 3, whose postcss-selector-parser ^6 is below its fix (7.1.6; tw-to-css OG images render byte-identically on 7.x); remove each override once the pinning package allows a patched version (for KaTeX, mermaid 12.2.0 and later allow ^0.18.0).", + "//": "typescript pinned to 6.x: TypeScript 7.0 (Go-based 'Project Corsa') removed the JS API (ts.sys), breaking twoslash (a dep of starlight-theme-nova) and @astrojs/check. js-yaml pinned to 4.x: v5 is ESM-only with no default export, which breaks astro's prerender (static-paths.js imports its default export). mermaid pinned to 11.x: astro-mermaid@2 supports mermaid 10/11 only, and mermaid 12 switches the default layout to ELK, re-laying out existing diagrams. Dependabot ignores major updates for all three; re-evaluate when upstream compatibility is added. @emnapi/core and @emnapi/runtime are listed directly because @astrojs/check needs them through @napi-rs/wasm-runtime, which only declares them as peers; with legacy-peer-deps they are otherwise left out on newer npm, and astro check then skips type checking and still exits 0. overrides: satori pins fflate to exactly 0.7.3 and tw-to-css pins postcss to exactly 8.4.31, and mermaid 11 requires KaTeX ^0.16.47, all below their security fixes; remove each override once the pinning package allows a patched version (for KaTeX, mermaid 12.2.0 and later allow ^0.18.0).", "scripts": { "dev": "astro dev", "start": "astro dev", @@ -60,8 +60,7 @@ "overrides": { "fflate": "^0.7.5", "postcss": "^8.5.23", - "katex": "^0.18.10", - "postcss-selector-parser": "^7.1.6" + "katex": "^0.18.10" }, "lavamoat": { "allowScripts": { From 2bd68046df5a6b0be29fd4d862e7d7c8cee8c8f3 Mon Sep 17 00:00:00 2001 From: Eric Seidel Date: Fri, 23 Oct 2026 15:15:13 -0700 Subject: [PATCH 3/3] Update expressive-code to 0.44.3 for postcss-selector-parser 7 Starlight's code-block renderer loads postcss-nested, which loaded the vulnerable postcss-selector-parser 6.1.4 on every build. expressive-code 0.44.3 (within Starlight's range) moves to postcss-nested 7 and postcss-selector-parser 7.1.7. Built site output is unchanged. Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 106 +++++++++++++++++++++++++++++++--------------- 1 file changed, 72 insertions(+), 34 deletions(-) diff --git a/package-lock.json b/package-lock.json index c3339a6a..4657dd25 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1780,9 +1780,9 @@ } }, "node_modules/@ctrl/tinycolor": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/@ctrl/tinycolor/-/tinycolor-4.2.0.tgz", - "integrity": "sha512-kzyuwOAQnXJNLS9PSyrk0CWk35nWJW/zl/6KvnTBMFK65gm7U1/Z5BqjxeapjZCIhQcM/DsrEmcbRwDyXyXK4A==", + "version": "4.2.1", + "resolved": "https://registry.npmjs.org/@ctrl/tinycolor/-/tinycolor-4.2.1.tgz", + "integrity": "sha512-Vh5uy9Y1JBMId6J1f68TMXnZrTCvNdo9Fu2k0d1YnJngR+sM5kWTKl441c/3TFs+cG0NWOjRWgQ/iaWhbYx+7A==", "license": "MIT", "engines": { "node": ">=14" @@ -1889,9 +1889,9 @@ } }, "node_modules/@expressive-code/core": { - "version": "0.44.0", - "resolved": "https://registry.npmjs.org/@expressive-code/core/-/core-0.44.0.tgz", - "integrity": "sha512-xgiF2P6tYUbrhi3+x0S8xHZWT1t3Bvb3U91tAtRbLb9HLejLvYc5GZUqKICKLaUN4iSGhhNJu2fM/aH8e5yCMg==", + "version": "0.44.3", + "resolved": "https://registry.npmjs.org/@expressive-code/core/-/core-0.44.3.tgz", + "integrity": "sha512-pffktF0TJoxC08dgNcutl/0LcSnTrjF6vXR39qVpwZ0EyxpwO9zjI7dbni6sO7w3yHpRBO0voLFvhzB+EPJRsA==", "license": "MIT", "dependencies": { "@ctrl/tinycolor": "^4.0.4", @@ -1900,37 +1900,75 @@ "hast-util-to-text": "^4.0.1", "hastscript": "^9.0.0", "postcss": "^8.4.38", - "postcss-nested": "^6.0.1", + "postcss-nested": "^7.0.2", "unist-util-visit": "^5.0.0", "unist-util-visit-parents": "^6.0.1" } }, + "node_modules/@expressive-code/core/node_modules/postcss-nested": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/postcss-nested/-/postcss-nested-7.0.2.tgz", + "integrity": "sha512-5osppouFc0VR9/VYzYxO03VaDa3e8F23Kfd6/9qcZTUI8P58GIYlArOET2Wq0ywSl2o2PjELhYOFI4W7l5QHKw==", + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "postcss-selector-parser": "^7.0.0" + }, + "engines": { + "node": ">=18.0" + }, + "peerDependencies": { + "postcss": "^8.2.14" + } + }, + "node_modules/@expressive-code/core/node_modules/postcss-selector-parser": { + "version": "7.1.7", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.7.tgz", + "integrity": "sha512-wWBro/7hJ40ye6TPiXkUQoXKCw23xSsjriUvqd7Uls9Sso3oLiON1flc18cCdnjgCRXw4fBVqUJJeOdDTh3P3g==", + "license": "MIT", + "dependencies": { + "cssesc": "^3.0.0", + "util-deprecate": "^1.0.2" + }, + "engines": { + "node": ">=4" + } + }, "node_modules/@expressive-code/plugin-frames": { - "version": "0.44.0", - "resolved": "https://registry.npmjs.org/@expressive-code/plugin-frames/-/plugin-frames-0.44.0.tgz", - "integrity": "sha512-V6M6+zVc1GzqCvXkQHc2m5rcFOIVzJgMq5gnfrMnVf2gwtj/sg4H93c1f/mGeqHycubwkHFUDyParAOiGeDZeA==", + "version": "0.44.3", + "resolved": "https://registry.npmjs.org/@expressive-code/plugin-frames/-/plugin-frames-0.44.3.tgz", + "integrity": "sha512-ysW4VXk9vXEliA99Ur6ApUepVtx74sPolp6o/j45BRjZQoL5O6kXKMhSP4koQLih8HbC5B3ImIvO+HKKhkv/oA==", "license": "MIT", "dependencies": { - "@expressive-code/core": "^0.44.0" + "@expressive-code/core": "^0.44.3" } }, "node_modules/@expressive-code/plugin-shiki": { - "version": "0.44.0", - "resolved": "https://registry.npmjs.org/@expressive-code/plugin-shiki/-/plugin-shiki-0.44.0.tgz", - "integrity": "sha512-RZsdaqlbGqyAQKuoX4myQXxjmiE2l5KBpJ/gKPh62tCdIdpWyjbzVqSo8+5XsezZxkfi8AJ/J6EUaBTPROFX/Q==", + "version": "0.44.3", + "resolved": "https://registry.npmjs.org/@expressive-code/plugin-shiki/-/plugin-shiki-0.44.3.tgz", + "integrity": "sha512-jAibAZPG7lDmi61EFJADZjoSZzjHiwZZdbbgR/mTlWXM4ON/Pyo/9tB2vrqQNKylsci6jqtCi6idrwqQXF53xA==", "license": "MIT", "dependencies": { - "@expressive-code/core": "^0.44.0", + "@expressive-code/core": "^0.44.3", "shiki": "^4.0.2" } }, "node_modules/@expressive-code/plugin-text-markers": { - "version": "0.44.0", - "resolved": "https://registry.npmjs.org/@expressive-code/plugin-text-markers/-/plugin-text-markers-0.44.0.tgz", - "integrity": "sha512-0/m3A5b+lz2upyNq+wzZ1S69HRoJmyFs5LsR42lVZ9pmGRlBiSBYQpvqlji4DBj1+Riamxc0AvcCr5kuzOQeWA==", + "version": "0.44.3", + "resolved": "https://registry.npmjs.org/@expressive-code/plugin-text-markers/-/plugin-text-markers-0.44.3.tgz", + "integrity": "sha512-4Ae2xRSDV5kdWPsi40xWbOtoihbzM0zLVjQKkDAnD5KzFXl+6/kd+VhuWOlTRVaJ5cqGk++vCbAaf0MR1XbZlw==", "license": "MIT", "dependencies": { - "@expressive-code/core": "^0.44.0" + "@expressive-code/core": "^0.44.3" } }, "node_modules/@floating-ui/core": { @@ -4852,12 +4890,12 @@ } }, "node_modules/astro-expressive-code": { - "version": "0.44.0", - "resolved": "https://registry.npmjs.org/astro-expressive-code/-/astro-expressive-code-0.44.0.tgz", - "integrity": "sha512-b1wN/ZvbJprzxlGKIpIes2kQrCY5KRLwys2tWbZAZyjGZcW5ZtgneZnBwzNRiBna9/48d4mQl19KLjcRuhO1hw==", + "version": "0.44.3", + "resolved": "https://registry.npmjs.org/astro-expressive-code/-/astro-expressive-code-0.44.3.tgz", + "integrity": "sha512-LUpQmmvzr90JXP5QIAopgdjlOKLuT3x0wlPAUpc4OZtPtFS8sbflPcGPpL/lG3pQuUCQV2CXUFgYNBYNu9tphA==", "license": "MIT", "dependencies": { - "rehype-expressive-code": "^0.44.0", + "rehype-expressive-code": "^0.44.3", "url-extras": "^0.1.0" }, "peerDependencies": { @@ -7017,15 +7055,15 @@ "license": "Apache-2.0" }, "node_modules/expressive-code": { - "version": "0.44.0", - "resolved": "https://registry.npmjs.org/expressive-code/-/expressive-code-0.44.0.tgz", - "integrity": "sha512-JXVWVNCKlLuZLMQH8cOiDUSosT0Bb+elwE/dbAkpwFwDFmyFyWlECoWZIohh2FkIF1iI67TQJ+Ts9k7oNDh2qA==", + "version": "0.44.3", + "resolved": "https://registry.npmjs.org/expressive-code/-/expressive-code-0.44.3.tgz", + "integrity": "sha512-7RGslhJTNt01pdn5I3QmVh5C8ZIiSm0A+ORQ9j9r39oOgJVKjn/7dXl9rMT/SqmFLE6pJkTYI7UjW0BxJnW7OQ==", "license": "MIT", "dependencies": { - "@expressive-code/core": "^0.44.0", - "@expressive-code/plugin-frames": "^0.44.0", - "@expressive-code/plugin-shiki": "^0.44.0", - "@expressive-code/plugin-text-markers": "^0.44.0" + "@expressive-code/core": "^0.44.3", + "@expressive-code/plugin-frames": "^0.44.3", + "@expressive-code/plugin-shiki": "^0.44.3", + "@expressive-code/plugin-text-markers": "^0.44.3" } }, "node_modules/extend": { @@ -10955,12 +10993,12 @@ } }, "node_modules/rehype-expressive-code": { - "version": "0.44.0", - "resolved": "https://registry.npmjs.org/rehype-expressive-code/-/rehype-expressive-code-0.44.0.tgz", - "integrity": "sha512-5r74C5F2sMR3X+QJH8OKWgZBO/cqRw5W1fLT6GVlSfLqepk+4j8tGFkyPqZYWjwntsBHzKPDH2zI68sZ7ScLfA==", + "version": "0.44.3", + "resolved": "https://registry.npmjs.org/rehype-expressive-code/-/rehype-expressive-code-0.44.3.tgz", + "integrity": "sha512-vaVuQPobFXvmtcHXQ5uqXZlzuuPnLyIuZcX/03sX1U/Qfj9fZrPYI9w66OSr/PUx6alzRYmreEwgYBbsVx8HsA==", "license": "MIT", "dependencies": { - "expressive-code": "^0.44.0" + "expressive-code": "^0.44.3" } }, "node_modules/rehype-minify-whitespace": {