From 8834793c2db0bd6f3ea9895fd628b52ab070a92e Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Wed, 2 Sep 2026 12:37:48 +0000 Subject: [PATCH 1/2] chore: upgrade postcss-selector-parser to ^6.1.4 to address CVE-2026-9358 Refreshes the ^6.1.1/^6.1.2 lockfile entries and adds a qualified resolution for the exact 6.0.10 pin that @tailwindcss/typography requests, which no published version of that plugin has relaxed. Co-Authored-By: Claude Opus 5 (1M context) --- package.json | 3 ++- yarn.lock | 18 ++++-------------- 2 files changed, 6 insertions(+), 15 deletions(-) diff --git a/package.json b/package.json index 1373f3f4e..df0ace807 100644 --- a/package.json +++ b/package.json @@ -65,6 +65,7 @@ "uuid": "^14.0.0", "fast-uri@npm:^3.0.1": "^3.1.2", "shell-quote@npm:1.8.3": "^1.8.4", - "ws@npm:~8.20.1": "^8.21.0" + "ws@npm:~8.20.1": "^8.21.0", + "postcss-selector-parser@npm:6.0.10": "^6.1.3" } } diff --git a/yarn.lock b/yarn.lock index 72e868b30..03a7ba84f 100644 --- a/yarn.lock +++ b/yarn.lock @@ -19447,23 +19447,13 @@ __metadata: languageName: node linkType: hard -"postcss-selector-parser@npm:6.0.10": - version: 6.0.10 - resolution: "postcss-selector-parser@npm:6.0.10" - dependencies: - cssesc: "npm:^3.0.0" - util-deprecate: "npm:^1.0.2" - checksum: 10c0/a0b27c5e3f7604c8dc7cd83f145fdd7b21448e0d86072da99e0d78e536ba27aa9db2d42024c50aa530408ee517c4bdc0260529e1afb56608f9a82e839c207e82 - languageName: node - linkType: hard - -"postcss-selector-parser@npm:^6.1.1, postcss-selector-parser@npm:^6.1.2": - version: 6.1.2 - resolution: "postcss-selector-parser@npm:6.1.2" +"postcss-selector-parser@npm:^6.1.1, postcss-selector-parser@npm:^6.1.2, postcss-selector-parser@npm:^6.1.3": + version: 6.1.4 + resolution: "postcss-selector-parser@npm:6.1.4" dependencies: cssesc: "npm:^3.0.0" util-deprecate: "npm:^1.0.2" - checksum: 10c0/523196a6bd8cf660bdf537ad95abd79e546d54180f9afb165a4ab3e651ac705d0f8b8ce6b3164fb9e3279ce482c5f751a69eb2d3a1e8eb0fd5e82294fb3ef13e + checksum: 10c0/996f3290dee08ecb073d5f396d1134e619494cfd83140aec07a29618ee1e76d370769a8959d4c0cfefb24aa96dcffa4e7c4937dd881e03b735d50cba959ceb19 languageName: node linkType: hard From cb489398f3a537bc5d41aa09a141bd994e043fb6 Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Wed, 2 Sep 2026 12:38:17 +0000 Subject: [PATCH 2/2] chore: add CHANGELOG entry for postcss-selector-parser upgrade Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 62c52fc2d..a8dc1cccc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Upgraded `browserslist` to `^4.28.8`. [#1624](https://github.com/sourcebot-dev/sourcebot/pull/1624) +- Upgraded `postcss-selector-parser` to `^6.1.4`. [#1625](https://github.com/sourcebot-dev/sourcebot/pull/1625) ## [5.1.10] - 2026-08-27