wushenghua/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): 升 postcss 到 >=8.5.18 修复 frontend-security 红灯

Browse Source 
新披露两条 high 级公告命中锁文件里的 postcss@8.5.6，frontend-security 的
audit exception 检查失败：

- GHSA-6g55-p6wh-862q（2026-07-23 披露，修复版 8.5.12）
  CSS 注释中攻击者可控的 sourceMappingURL 导致任意文件读取与信息泄露
- GHSA-r28c-9q8g-f849（2026-07-24 披露，修复版 8.5.18）
  Previous Source Map 自动加载存在路径穿越，导致任意 .map 文件泄露

postcss 不只是 devDependency —— 它经 vue → @vue/compiler-sfc 进入生产依赖树，
因此 `pnpm audit --prod` 会命中。用 pnpm.overrides 而非只升直接依赖，可保证
所有引入路径的实例都被抬到修复版（沿用本仓 form-data@<4.0.6 的既有写法）。

锁文件用 pnpm 10 重新解析以匹配现有锁文件的生成工具，避免 pnpm 9 误删
11 处 libc: [glibc|musl] 平台门控字段；lockfileVersion 保持 9.0。
实际解析到 postcss 8.5.23，nanoid 3.3.11→3.3.16 是 postcss 自身依赖的
补丁级跟随，diff 无其他无关变动。

验证：复现 CI 失败步骤（pnpm audit --prod --audit-level=high +
tools/check_pnpm_audit_exceptions.py）已通过；CI 所用 pnpm 9 的
--frozen-lockfile 接受该锁文件；vue-tsc --noEmit、pnpm build、vitest 均通过。
This commit is contained in:
shaw
2026-07-25 11:45:42 +08:00
parent 6c9b84cc7a
commit a5aae5db9a
2 changed files with 35 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/package.json
+2 -1
View File
@@ -62,7 +62,8 @@
"pnpm": {
"overrides": {
"js-cookie": "3.0.7",
"form-data@<4.0.6": ">=4.0.6"
"form-data@<4.0.6": ">=4.0.6",
"postcss@<8.5.18": ">=8.5.18"
}
}
}
frontend/pnpm-lock.yaml
Generated
+33 -32
View File
@@ -7,6 +7,7 @@ settings:
overrides:
js-cookie: 3.0.7
form-data@<4.0.6: '>=4.0.6'
postcss@<8.5.18: '>=8.5.18'
importers:
@@ -105,7 +106,7 @@ importers:
version: 2.4.6
autoprefixer:
specifier: ^10.4.16
version: 10.4.23(postcss@8.5.6)
version: 10.4.23(postcss@8.5.23)
eslint:
specifier: ^8.57.0
version: 8.57.1
@@ -116,8 +117,8 @@ importers:
specifier: ^24.1.3
version: 24.1.3
postcss:
specifier: ^8.4.32
version: 8.5.6
specifier: '>=8.5.18'
version: 8.5.23
tailwindcss:
specifier: ^3.4.0
version: 3.4.19
@@ -1876,7 +1877,7 @@ packages:
engines: {node: ^10 || ^12 || >=14}
hasBin: true
peerDependencies:
postcss: ^8.1.0
postcss: '>=8.5.18'
axios@1.18.1:
resolution: {integrity: sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==}
@@ -3321,8 +3322,8 @@ packages:
mz@2.7.0:
resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
nanoid@3.3.11:
resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
nanoid@3.3.16:
resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==}
engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
hasBin: true
@@ -3511,20 +3512,20 @@ packages:
resolution: {integrity: sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==}
engines: {node: '>=14.0.0'}
peerDependencies:
postcss: ^8.0.0
postcss: '>=8.5.18'
postcss-js@4.1.0:
resolution: {integrity: sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==}
engines: {node: ^12 || ^14 || >= 16}
peerDependencies:
postcss: ^8.4.21
postcss: '>=8.5.18'
postcss-load-config@6.0.1:
resolution: {integrity: sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==}
engines: {node: '>= 18'}
peerDependencies:
jiti: '>=1.21.0'
postcss: '>=8.0.9'
postcss: '>=8.5.18'
tsx: ^4.8.1
yaml: ^2.4.2
peerDependenciesMeta:
@@ -3541,7 +3542,7 @@ packages:
resolution: {integrity: sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==}
engines: {node: '>=12.0'}
peerDependencies:
postcss: ^8.2.14
postcss: '>=8.5.18'
postcss-selector-parser@6.1.2:
resolution: {integrity: sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==}
@@ -3550,8 +3551,8 @@ packages:
postcss-value-parser@4.2.0:
resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
postcss@8.5.6:
resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==}
postcss@8.5.23:
resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==}
engines: {node: ^10 || ^12 || >=14}
prelude-ls@1.2.1:
@@ -6284,7 +6285,7 @@ snapshots:
'@vue/shared': 3.5.26
estree-walker: 2.0.2
magic-string: 0.30.21
postcss: 8.5.6
postcss: 8.5.23
source-map-js: 1.2.1
'@vue/compiler-ssr@3.5.26':
@@ -6515,13 +6516,13 @@ snapshots:
attr-accept@2.2.5: {}
autoprefixer@10.4.23(postcss@8.5.6):
autoprefixer@10.4.23(postcss@8.5.23):
dependencies:
browserslist: 4.28.1
caniuse-lite: 1.0.30001761
fraction.js: 5.3.4
picocolors: 1.1.1
postcss: 8.5.6
postcss: 8.5.23
postcss-value-parser: 4.2.0
axios@1.18.1:
@@ -8442,7 +8443,7 @@ snapshots:
object-assign: 4.1.1
thenify-all: 1.6.0
nanoid@3.3.11: {}
nanoid@3.3.16: {}
natural-compare@1.4.0: {}
@@ -8607,28 +8608,28 @@ snapshots:
dependencies:
'@babel/runtime': 7.28.4
postcss-import@15.1.0(postcss@8.5.6):
postcss-import@15.1.0(postcss@8.5.23):
dependencies:
postcss: 8.5.6
postcss: 8.5.23
postcss-value-parser: 4.2.0
read-cache: 1.0.0
resolve: 1.22.11
postcss-js@4.1.0(postcss@8.5.6):
postcss-js@4.1.0(postcss@8.5.23):
dependencies:
camelcase-css: 2.0.1
postcss: 8.5.6
postcss: 8.5.23
postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.6):
postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.23):
dependencies:
lilconfig: 3.1.3
optionalDependencies:
jiti: 1.21.7
postcss: 8.5.6
postcss: 8.5.23
postcss-nested@6.2.0(postcss@8.5.6):
postcss-nested@6.2.0(postcss@8.5.23):
dependencies:
postcss: 8.5.6
postcss: 8.5.23
postcss-selector-parser: 6.1.2
postcss-selector-parser@6.1.2:
@@ -8638,9 +8639,9 @@ snapshots:
postcss-value-parser@4.2.0: {}
postcss@8.5.6:
postcss@8.5.23:
dependencies:
nanoid: 3.3.11
nanoid: 3.3.16
picocolors: 1.1.1
source-map-js: 1.2.1
@@ -9253,11 +9254,11 @@ snapshots:
normalize-path: 3.0.0
object-hash: 3.0.0
picocolors: 1.1.1
postcss: 8.5.6
postcss-import: 15.1.0(postcss@8.5.6)
postcss-js: 4.1.0(postcss@8.5.6)
postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.6)
postcss-nested: 6.2.0(postcss@8.5.6)
postcss: 8.5.23
postcss-import: 15.1.0(postcss@8.5.23)
postcss-js: 4.1.0(postcss@8.5.23)
postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.23)
postcss-nested: 6.2.0(postcss@8.5.23)
postcss-selector-parser: 6.1.2
resolve: 1.22.11
sucrase: 3.35.1
@@ -9489,7 +9490,7 @@ snapshots:
vite@5.4.21(@types/node@20.19.27):
dependencies:
esbuild: 0.21.5
postcss: 8.5.6
postcss: 8.5.23
rollup: 4.54.0
optionalDependencies:
'@types/node': 20.19.27