Repository navigation
build(deps): pin tinypool and postcss-nested past open advisories - #2241
Conversation
tinypool 2.1.0 (GHSA-5gmw-xhrv-c9v3, GHSA-85c8-ppgw-ccpr) is pinned exactly by oxfmt 0.52.0, which vite-plus 0.1.24 pins in turn, so override it to 2.1.2. In docs, postcss-nested 6 (from expressive-code) holds postcss-selector-parser on 6.x, and the fix for GHSA-rj75-hqrm-r3gf exists only in 7.1.6, so override postcss-nested to 7.0.2.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes the main changes: pinning tinypool and postcss-nested to address open advisories. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the package pins,
Then hops through tidy manifest lines. tinypool rests at two-one-two, postcss-nested has its version too.
The old postcss pin stays in place,
And bunny bounds away with grace.
Comment @coderabbitai help to get the list of available commands.
Deploying quickadd with
|
| Latest commit: |
534555d
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://f7bbd86a.quickadd.pages.dev |
| Branch Preview URL: | https://build-patch-dependabot-alert.quickadd.pages.dev |
1 participant
Closes three open Dependabot alerts that Dependabot could not fix on its own because each vulnerable package is held back by an exact or major-range pin further up the tree.
Changes
tinypoolto 2.1.2. It fixes GHSA-5gmw-xhrv-c9v3 and GHSA-85c8-ppgw-ccpr (alerts [BUG] <% tp.file.cursor() %> doesn't work. #149, [FEATURE REQUEST] suggester to value syntax #148). oxfmt 0.52.0 pinstinypoolto=2.1.0, and vite-plus 0.1.24 (a peer of obsidian-e2e) pins oxfmt exactly. This is dev tooling only.postcss-nestedto 7.0.2. expressive-code 0.44.2 requirespostcss-nested@^6, which holdspostcss-selector-parseron 6.x. The fix for GHSA-rj75-hqrm-r3gf (alert [BUG] Only works when the core template plugin is active #145) is only in 7.1.6. postcss-nested 7 drops Node 12-16 and changes where comments move, and the docs build output shows no difference.The alert for
braces(#137, GHSA-vfj7-8cjw-p6xm) stays open because no patched release exists yet.Verification
pnpm run buildpasses. All 54 HTML pages match the master build after normalizing Astro scope classes and asset hashes. The expressive-code stylesheetec.w36nc.csskeeps the same content hash.pnpm install --frozen-lockfile,pnpm run lint, andpnpm run testpass (501 files, 6892 tests).oxfmt --checkruns its worker pool on tinypool 2.1.2.Release impact
None. Both changes are dev and docs dependencies, and
build:commits do not trigger a release.Note
Pin tinypool and postcss-nested past open security advisories
Adds
tinypool@2.1.2as a direct dependency in package.json and a pnpm override pinningpostcss-nestedto 7.0.2 in docs/package.json. Updates both lockfiles to match.Macroscope summarized 534555d.
Summary by CodeRabbit