fix(security): bump postcss pin from 8.5.12 to 8.5.23#9351
Draft
bitgo-ai-agent-dev[bot] wants to merge 1 commit into
Draft
fix(security): bump postcss pin from 8.5.12 to 8.5.23#9351bitgo-ai-agent-dev[bot] wants to merge 1 commit into
bitgo-ai-agent-dev[bot] wants to merge 1 commit into
Conversation
Bumps the repo-wide postcss override/resolution from 8.5.12 to 8.5.23 to remediate GHSA-r28c-9q8g-f849 (CVSS 7.5, High). The advisory describes a path-traversal bug in PostCSS's sourceMappingURL auto-loading (lib/previous-map.js): a crafted sourceMappingURL containing ../ sequences could read arbitrary .map files from the filesystem. The fix in 8.5.18+ restricts source-map loading to the opts.from directory; 8.5.18 through 8.5.23 contain no further breaking changes. postcss is not a direct dependency of BitGoJS; it is pulled in transitively by css-loader, sanitize-html, @vue/compiler-sfc, and the web-demo app. Because the existing resolutions/overrides pin was already collapsing all four ranges (^8.2.14, ^8.2.15, ^8.3.11, ^8.5.6) to a single version, switching to 8.5.23 satisfies every range unchanged. None of BitGoJS's usages load source maps from outside opts.from, so the new restriction has no functional impact. This unblocks the "Publish @bitgo-beta" GitHub Actions workflow, which was failing at the osv-scanner "Enforce Vulnerability Severity Threshold" gate due to this advisory. Ticket: INF-2186 Session-Id: 87e939d9-34b0-414f-9c42-0dbca6398ab4 Task-Id: da7773f3-f9b6-44b0-b5df-ce432cca3a78
Contributor
ralph-bitgo
Bot
force-pushed
the
inf-2186-bump-postcss-cve
branch
from
July 24, 2026 19:59
a200865 to
a8a0257
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
postcsspin in both theresolutionsblock (Yarn classic) andoverridesblock (npm/pnpm/Yarn Berry) of the rootpackage.jsonfrom8.5.12to8.5.23.yarn.lockso the single consolidatedpostcssentry resolves to8.5.23instead of8.5.12.Why
GitHub Advisory GHSA-r28c-9q8g-f849 (CVSS 7.5, High) affects
postcss <= 8.5.17. The vulnerability is a path-traversal bug in PostCSS'ssourceMappingURLauto-loading (lib/previous-map.js): a craftedsourceMappingURLcontaining../../../../sequences can read arbitrary.mapfiles from the filesystem. The fix (introduced in 8.5.18) restricts source-map loading to theopts.fromdirectory.This advisory was failing the "Enforce Vulnerability Severity Threshold" osv-scanner gate in
.github/workflows/publish.yml, blocking all "Publish @bitgo-beta" runs before they reached the npm publish steps.postcssis not a direct dependency — it is pulled in transitively bycss-loader,sanitize-html,@vue/compiler-sfc, and themodules/web-demoapp. All four semver ranges (^8.2.14,^8.2.15,^8.3.11,^8.5.6) are satisfied by8.5.23. None of BitGoJS's usages load source maps from outsideopts.from, so the new restriction has no functional impact.Test plan
yarn.lockresolves a singlepostcss@8.5.23entry (no 8.5.12 remaining).Ticket: INF-2186