From 5814da2afb6e2d5900952e1da0905043c5ccdd41 Mon Sep 17 00:00:00 2001 From: SatoshiQaziMuhammed Date: Tue, 20 Oct 2026 22:51:27 +0400 Subject: [PATCH] fix(deps): override braces, source-map-js and postcss-selector-parser (#2) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three runtime advisories: - braces <= 3.0.3 (GHSA-vfj7-8cjw-p6xm, no upstream fix) → `npm:@pezkuwi/braces@^3.0.4`, our patched fork (as in pezkuwi-api); - source-map-js < 1.2.2 (GHSA-68fv-2mgg-jv7q) → ^1.2.2 (was 1.2.1); - postcss-selector-parser < 7.1.6 (GHSA-rj75-hqrm-r3gf) → ^7.1.6. It was 6.0.10/6.1.2 under tailwindcss and postcss-nested; telegram-miniapp carries the same override and builds. Lockfile regenerated with `npm install --package-lock-only`. Resolved versions: braces 3.0.4 (fork), source-map-js 1.2.2, postcss-selector-parser 7.1.7. --- package-lock.json | 77 ++++++++++++++++++++--------------------------- package.json | 5 +++ 2 files changed, 37 insertions(+), 45 deletions(-) diff --git a/package-lock.json b/package-lock.json index 930283a..6c4d9e9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3136,18 +3136,6 @@ "url": "https://github.com/sponsors/sindresorhus" } }, - "node_modules/braces": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz", - "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==", - "license": "MIT", - "dependencies": { - "fill-range": "^7.1.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/browserslist": { "version": "4.28.1", "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz", @@ -3236,6 +3224,19 @@ "fsevents": "~2.3.2" } }, + "node_modules/chokidar/node_modules/braces": { + "name": "@pezkuwi/braces", + "version": "3.0.4", + "resolved": "https://registry.npmjs.org/@pezkuwi/braces/-/braces-3.0.4.tgz", + "integrity": "sha512-OIjlOoXiXRS7ZHusTkaKbPVldj3t63x3rxtgcqnokjJW1gqdlEnT4QcsqDjLBS0qY20ZVqqnQUSnB1k5UxqbFQ==", + "license": "MIT", + "dependencies": { + "fill-range": "^7.1.1" + }, + "engines": { + "node": ">=8.3" + } + }, "node_modules/chokidar/node_modules/glob-parent": { "version": "5.1.2", "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", @@ -3645,6 +3646,19 @@ "node": ">=8.6" } }, + "node_modules/micromatch/node_modules/braces": { + "name": "@pezkuwi/braces", + "version": "3.0.4", + "resolved": "https://registry.npmjs.org/@pezkuwi/braces/-/braces-3.0.4.tgz", + "integrity": "sha512-OIjlOoXiXRS7ZHusTkaKbPVldj3t63x3rxtgcqnokjJW1gqdlEnT4QcsqDjLBS0qY20ZVqqnQUSnB1k5UxqbFQ==", + "license": "MIT", + "dependencies": { + "fill-range": "^7.1.1" + }, + "engines": { + "node": ">=8.3" + } + }, "node_modules/mz": { "version": "2.7.0", "resolved": "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz", @@ -3887,24 +3901,10 @@ "postcss": "^8.2.14" } }, - "node_modules/postcss-nested/node_modules/postcss-selector-parser": { - "version": "6.1.2", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz", - "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-selector-parser": { - "version": "6.0.10", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.10.tgz", - "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==", - "dev": true, + "version": "7.1.7", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.7.tgz", + "integrity": "sha512-wWBro/7hJ40ye6TPiXkUQoXKCw23xSsjriUvqd7Uls9Sso3oLiON1flc18cCdnjgCRXw4fBVqUJJeOdDTh3P3g==", "license": "MIT", "dependencies": { "cssesc": "^3.0.0", @@ -4173,9 +4173,9 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "license": "BSD-3-Clause", "engines": { "node": ">=0.10.0" @@ -4271,19 +4271,6 @@ "tailwindcss": ">=3.0.0 || insiders" } }, - "node_modules/tailwindcss/node_modules/postcss-selector-parser": { - "version": "6.1.2", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz", - "integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/thenify": { "version": "3.3.1", "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz", diff --git a/package.json b/package.json index e7e59df..d5ae303 100644 --- a/package.json +++ b/package.json @@ -60,5 +60,10 @@ "tailwindcss": "^3.4.11", "typescript": "^5.5.3", "vite": "^7.3.1" + }, + "overrides": { + "braces": "npm:@pezkuwi/braces@^3.0.4", + "source-map-js": "^1.2.2", + "postcss-selector-parser": "^7.1.6" } }