🚨 [security] Update postcss 8.3.0 → 8.5.6 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ postcss (8.3.0 → 8.5.6) · Repo · Changelog

Security Advisories 🚨

🚨 PostCSS line return parsing error

An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.

This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nanoid (indirect, 3.1.23 → 3.3.11) · Repo · Changelog

Security Advisories 🚨

🚨 Predictable results in nanoid generation when given non-integer values

When nanoid is called with a fractional value, there were a number of undesirable effects:

1. in browser and non-secure, the code infinite loops on while (size--)
2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.

🚨 Exposure of Sensitive Information to an Unauthorized Actor in nanoid

The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ source-map-js (indirect, 0.6.2 → 1.2.1) · Repo · Changelog

Release Notes

1.2.1

• Fix TS2306 “not a module” errors in type definitions (#16) @andersk

• Ensure null source is respected (#26) @dragomirtitian

• Improve ts declarations to be null-safe (#27) @dragomirtitian

1.2.0

Allow to pass options to SourceMapGenerator using SourceMapGenerator.fromSourceMap as second argument

var generator = sourceMap.SourceMapGenerator.fromSourceMap(new SourceMapConsumer(), {
  ignoreInvalidMapping: true,
});

• Add generator options to fromSourceMap (#22) @ai

1.1.0

Add ignoreInvalidMapping option to SourceMapGenerator. If enabled, source-map-js will not throw an error on the incorrect previous source map. Instead, it will print warnings and ignore broken mappings.

var generator = new sourceMap.SourceMapGenerator({
  file: "my-generated-javascript-file.js",
  sourceRoot: "http://example.com/app/js/",
  ignoreInvalidMapping: true,
});

• Do not throw an error since broken prev map is popular issue #20 (#20) @ai
• Add ignoreInvalidMapping option (#21) @7rulnik

1.0.3

• Use sourceContents when non-null, even if it's an empty string (#17) @bshepherdson

1.0.2 (from changelog)

• Add types for path imports (#13) @TrySound

1.0.1

• Remove cleanComments optimization (#10) @ai

1.0.0

Breaking Changes

Bundled files like source-map-js/dist/* doesn't exist anymore. Use source-map-js/lib/*.

PRs

• Fix package.json#typings field (#6) @chalkygames123
• Reduce memory usage of eachMapping w/ loop (#5) @noppa
• Reduce npm package size (#7) @ai

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 29 commits:

• 1.2.1
• Update changelog
• Improve ts declarations (#27)
• Ensure null source is respected. (#26)
• Fix TS2306 “not a module” errors in type definitions (#16)
• 1.2.0
• Update changelog
• Fix typo
• Add generator options to fromSourceMap (#22)
• 1.1.0
• Add ignoreInvalidMapping option (#21)
• Do not throw an error since broken prev map is popular issue (#20)
• Update CHANGELOG.md
• 1.0.3
• Update changelog
• Use sourceContents when non-null, even if it's an empty string (#17)
• 1.0.2
• update changelog
• Replace webpack with sass in readme
• Add types for path imports (#13)
• 1.0.1
• update changelog
• Remove cleanComments optimization (#10)
• 1.0.0
• update changelog
• Reduce npm package size (#7)
• Reduce memory usage of eachMapping w/ loop (#5)
• Fix `package.json#typings` field (#6)
• Port benchmark from upstream (#3)

🆕 picocolors (added, 1.1.1)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)