fix: add postcss resolutions override to address CVE-2026-41305#1191
Closed
brendan-kellam wants to merge 3 commits intomainfrom
Closed
fix: add postcss resolutions override to address CVE-2026-41305#1191brendan-kellam wants to merge 3 commits intomainfrom
brendan-kellam wants to merge 3 commits intomainfrom
Conversation
Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>
Contributor
WalkthroughThis PR adds a postcss version resolution override to force version ^8.5.10 in the root ChangesPostCSS Resolution Override
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>
Contributor
License Audit
Weak Copyleft Packages (informational)
Resolved Packages (11)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Line 18: Replace the current sentence about the postcss resolutions override
with the repository's CVE entry format: change the line to "Upgraded `postcss`
to `^8.5.10` to address CVE-2026-41305. [`#1191`]" and ensure this entry remains
under the [Unreleased] → Fixed section so it follows the mandated changelog
pattern.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9b3f5d56-64f9-498b-aeed-b36b2b8ad2d2
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (2)
CHANGELOG.mdpackage.json
| - Upgraded `hono` to `^4.12.18` to address CVE-2026-44455, CVE-2026-44456, CVE-2026-44457, CVE-2026-44458. [#1186](https://github.com/sourcebot-dev/sourcebot/pull/1186) | ||
| - Upgraded `ip-address` to `^10.2.0` to address CVE-2026-42338. [#1189](https://github.com/sourcebot-dev/sourcebot/pull/1189) | ||
| - Upgraded `fast-xml-builder` to `^1.2.0` to address CVE-2026-44664, CVE-2026-44665. [#1184](https://github.com/sourcebot-dev/sourcebot/pull/1184) | ||
| - Added `postcss` resolutions override to force all instances to `^8.5.10` to address CVE-2026-41305. [#1191](https://github.com/sourcebot-dev/sourcebot/pull/1191) |
Contributor
There was a problem hiding this comment.
Use the required CVE changelog sentence format
Please rewrite Line 18 to match the repository’s mandated CVE-entry pattern (Upgraded ... to ... to address ...) for consistency with security release notes.
Suggested edit
-- Added `postcss` resolutions override to force all instances to `^8.5.10` to address CVE-2026-41305. [`#1191`](https://github.com/sourcebot-dev/sourcebot/pull/1191)
+- Upgraded `postcss` to `^8.5.10` to address CVE-2026-41305. [`#1191`](https://github.com/sourcebot-dev/sourcebot/pull/1191)As per coding guidelines, "CHANGELOG entry for CVE fixes should follow the format: Upgraded \` to `^x.y.z` to address CVE-A, CVE-B, .... [#]under the[Unreleased] → Fixed` section."
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - Added `postcss` resolutions override to force all instances to `^8.5.10` to address CVE-2026-41305. [#1191](https://github.com/sourcebot-dev/sourcebot/pull/1191) | |
| - Upgraded `postcss` to `^8.5.10` to address CVE-2026-41305. [`#1191`](https://github.com/sourcebot-dev/sourcebot/pull/1191) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CHANGELOG.md` at line 18, Replace the current sentence about the postcss
resolutions override with the repository's CVE entry format: change the line to
"Upgraded `postcss` to `^8.5.10` to address CVE-2026-41305. [`#1191`]" and ensure
this entry remains under the [Unreleased] → Fixed section so it follows the
mandated changelog pattern.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes SOU-995
Summary
This PR adds a Yarn resolutions override to force all PostCSS instances (including the transitive dependency from Next.js) to use version ^8.5.10, which addresses CVE-2026-41305.
Background
CVE-2026-41305 is an XSS vulnerability in PostCSS versions prior to 8.5.10. The vulnerability allows unescaped
</style>sequences in CSS AST stringification, which can break out of style contexts and enable XSS attacks.PR #1155 previously upgraded the direct PostCSS devDependency in
packages/web/package.jsonfrom^8to^8.5.10. However, Next.js 16.2.3 has a pinned dependency on PostCSS 8.4.31 (vulnerable), which was not addressed by the direct dependency upgrade.Changes
"postcss@npm:8.4.31": "^8.5.10"to theresolutionssection in the rootpackage.jsonyarn.lockto reflect the new resolution (all PostCSS instances now resolve to 8.5.12)Verification
Before fix:
After fix:
All PostCSS instances now use 8.5.12 (>= 8.5.10, the patched version).
References
Linear Issue: SOU-995
Summary by CodeRabbit