Resolve remaining bundled npm selector-parser security update #739

Activity

1. github-actions

   assigned

   Jamie-BitFlight

   on Oct 11, 2026
2. Jamie-BitFlight commented on Oct 11, 2026

   

   Jamie-BitFlight

   on Oct 11, 2026 – with ChatGPT Codex Connector

   ContributorAuthor

   More actions

   Rechecked on 2026-10-11: three updates remain blocked; a bare TOML override regresses configuration

   Current main is e6b72c68992394022b1ceb11b93b8b95d6f24738 (release 2.0.6). Its resolved dependency graph matches tested commit 05ac0f262500678fb729b045967d9b44f8acc015, except for project-version fields. PRs #736–#738 are merged and do not remove these three affected versions.

   Confirmed versions and blockers

   Package	Installed / advisory severity	Required upstream change
   postcss-selector-parser	7.1.4; Moderate	A supported npm release must actually bundle parser >=7.1.6. A parent update resolved @semantic-release/npm@13.2.0 and npm@11.21.0, but both the resulting lock and npm's actual registry tarball still contained parser7.1.4.
   katex	0.16.47; Low	Published math/markdownlint parents must admit KaTeX >=0.18.2. Latest markdownlint0.41.1 pins math extension3.1.0, whose published range remains ^0.16.0.
   smol-toml	1.7.2; Moderate	The linter must first preserve nested options from null-prototype TOML tables, then accept parser >=1.9.0. Latest published CLI0.49.1 requires ~1.7.0; overriding it to1.9.1 reproduced the regression below.

   Primary advisories: selector parser, KaTeX, smol-toml.

   TOML is reachable from Markdown content

   The CLI forwards its configuration parsers into markdownlint. Core markdownlint scans the document for multiline markdownlint-configure-file comments and sends their bodies through those same parsers. The repository's JSONC project configuration does not prevent that route.

   A native Node24.19.0 probe using the actual CLI0.49.1/core0.41.1 and exact repository config observed one TOML parse for a directive containing100 harmless keys. Ordinary math Markdown and a JSON directive produced zero TOML calls. This establishes development/CI exposure when linting supplied Markdown, without running a large resource-exhaustion payload.

   The initial ordinary-math probe did not exercise inline directives. The later independent probe corrected the overly broad inference from that first result.

   Sources: CLI forwarding, core inline configuration processing.

   Tested override: not mergeable

   A scoped npm override successfully installed smol-toml1.9.1, but this valid directive changed behavior:

   <!-- markdownlint-configure-file
   [MD013]
   line_length = 500
   -->

   Follow it with a149-character prose line:

   • smol-toml1.7.2: lint passes.
   • smol-toml1.9.1: lint fails with MD013 ... Expected: 80; Actual: 149.
   • Equivalent JSON configuration with limit500 passes under both versions.
   • TOML and JSON limit80 controls both fail as expected.

   Two independent consumer checks reproduced this. Parser1.9.1 returns null-prototype tables; markdownlint0.41.1's value instanceof Object check fails for the nested MD013 table and discards line_length. The fixed1.9.0 tarball also creates null-prototype tables.

   Upstream CLI commit5cd5c9f widens smol-toml to1.9 without a consumer correction. Its green checks do not establish preservation of this behavior. A safe update needs the consumer correction together with the fixed parser. The local override was rejected and restored; no candidate PR or implementation change was published.

   Other runtime boundaries

   All three affected nodes are development-only dependencies.

   • Selector parsing belongs to semantic-release → @semantic-release/npm → npm → @npmcli/query. Inspected release paths invoke fixed npm version/pack/publish commands; no route from generator input into an npm query selector was established.
   • Markdownlint imports the math package but uses syntax/tokenization. The math fixture and inline-configuration probes made zero KaTeX renderer calls; explicit HTML-rendering controls activated the renderer. The KaTeX advisory requires additional prototype-pollution/options preconditions and affected rendering. No such generator path was established.

   These are scoped runtime observations, not a claim that arbitrary local npm selectors, TOML input, or KaTeX applications are safe.

   Verification and disposition

   • Production lock audit: exit0, no findings.
   • Full lock audit: exit1,27 affected-package nodes including propagated parent findings. Additional advisory nodes are now separately tracked in Triage remaining development dependency audit findings #740.
   • Ordinary and targeted parent-update probes: exit0, all three affected leaves retained.
   • Candidate parser installation: succeeded; behavioral compatibility checks: failed, as above.
   • Current main's tests/coverage/build/docs/release, external integration, lint, and CodeQL passed. Actual Node24.19.0 and26.11.1 jobs each ran722 tests in25 files, twice including coverage. npm/GitHub release2.0.6 completed.
   • The rejected candidate did not proceed to a full application-suite/CI run because its direct consumer regression already made it unsuitable.

   Keep #739 open. Prioritize the paired TOML consumer/parser fix. Recheck the other parent releases when available. Any eventual update must remove the actual affected nested resolutions and pass the repository's lint/type/test/build/package integration gates before closure. Existing weekly npm Dependabot configuration has no ignore rule for these packages.
3. Jamie-BitFlight

   added a commit that references this issue on Oct 11, 2026

   chore(lint): replace markdownlint-cli with rumdl (#741)

   ...

   d188415
4. Jamie-BitFlight

   changed the title [-]Resolve three blocked Dependabot security updates[/-] [+]Resolve remaining bundled npm selector-parser security update[/+] on Oct 11, 2026
5. Jamie-BitFlight commented on Oct 12, 2026

   

   Jamie-BitFlight

   on Oct 12, 2026 – with ChatGPT Codex Connector

   ContributorAuthor

   More actions

   Follow-up after #742 / 2.0.7:

   I checked the current supported release-tool paths rather than assuming a parent bump would refresh npm's bundle.

   • @semantic-release/npm@13.2.0 still locks npm@11.19.1 with postcss-selector-parser@7.1.4.
   • npm 11.20.0 still bundles postcss-selector-parser@7.1.4.
   • npm 11.21.0's published dependency change is unrelated to this subtree.
   • npm 12.2.0 also still bundles postcss-selector-parser@7.1.4.

   The same npm 12.2.0 lock also retains the affected bundled brace-expansion@5.0.9, http-cache-semantics@4.2.0, ip-address@10.5.0, and undici@6.28.0 versions tracked in #740.

   So neither the current stable semantic-release npm plugin nor moving to npm 12 provides a remediation. Keep #739 upstream-blocked until npm's bundle (or its @npmcli/query path) actually resolves a patched selector parser; do not add an override solely to silence the alert.