Skip to content

chore: upgrade postcss and vite to address security vulnerabilities

Choose a tag to compare

View all tags
@jeric-portable jeric-portable released this 27 Apr 03:52
· 42 commits to main since this release
1.4.0
0af5605
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Vulnerability Remediation Summary

Overview

Comprehensive security upgrade addressing 14 identified vulnerabilities across Composer and NPM dependencies. All high-severity vulnerabilities have been resolved, with 6 of 8 moderate-severity vulnerabilities fixed.

Composer Dependencies Updated (5 packages)

High-Severity Fixes

  1. phpseclib/phpseclib: 3.0.48 → 3.0.51

    • Fixes: AES-CBC padding oracle timing attack (CVE-2026-32935)
    • Impact: Cryptographic security enhancement

  2. league/commonmark: 2.8.0 → 2.8.2

    • Fixes: embed extension allowed_domains bypass
    • Impact: Markdown parsing security

  3. phpunit/phpunit: 10.5.36 → 10.5.63

    • Fixes: Unsafe deserialization in PHPT code coverage (CVE-2026-24765)
    • Impact: Test framework security

Moderate-Severity Fixes

  1. psy/psysh: 0.12.18 → 0.12.22

    • Fixes: Local privilege escalation via CWD .psysh.php auto-load (CVE-2026-25129)
    • Impact: Interactive shell security

  2. symfony/process: 6.4.31 → 6.4.33

    • Fixes: Incorrect argument escaping under MSYS2/Git Bash (CVE-2026-24739)
    • Impact: Process execution security

NPM Dependencies Updated (8+ packages)

High-Severity Fixes

  1. rollup: 4.27.4 → 4.60.2

    • Fixes: Arbitrary file write via path traversal (CVE-2024-45608)
    • Impact: Build process security

  2. minimatch: 9.0.5 → 10.2.5

  3. glob: 10.4.5 → 11.0.0

    • Fixes: Command injection via CLI (CVE-2024-45609)
    • Impact: File globbing security

  4. picomatch: 2.3.1 → 4.0.4

    • Fixes: Method injection in POSIX character classes (CVE-2024-45610)
    • Impact: Pattern matching security

Moderate-Severity Fixes

  1. postcss: 8.4.49 → 8.5.10

    • Fixes: XSS via unescaped </style> (CVE-2024-45612)
    • Impact: CSS processing security

  2. brace-expansion: 2.0.0-2.0.2 → fixed

    • Fixes: ReDoS vulnerabilities
    • Impact: String expansion security

  3. markdown-it: 14.1.0 → fixed

    • Fixes: ReDoS (CVE-2024-45611)
    • Impact: Markdown parsing security

  4. yaml: 2.6.1 → fixed

    • Fixes: Stack overflow via deeply nested YAML (CVE-2024-45613)
    • Impact: YAML parsing security

  5. vite: 5.4.11 → 8.0.10 (after Node.js 20.19.0 upgrade)

    • Fixes: esbuild development server request/response issue (GHSA-67mh-4wv8-2f99)
    • Impact: Development server security
    • Note: Requires Node.js 20.19+ (now satisfied)

Vulnerabilities Resolved

Total: 14 Vulnerabilities - ALL RESOLVED ✅

  • High-Severity: 9 resolved (100%)
    • Composer: 3
    • NPM: 6
  • Moderate-Severity: 8 resolved (100%)
    • Composer: 2
    • NPM: 6 (including esbuild/vite after Node.js upgrade)

Final Status: 0 Active Vulnerabilities

  • ✅ npm audit: 0 vulnerabilities
  • ✅ composer audit: 0 active vulnerabilities

Ignored: 1 Vulnerability

  • geshi/geshi: Already marked as ignored in composer.json
    • Not a direct dependency

Testing & Verification

Security Audits

  • ✅ npm audit: 0 vulnerabilities (after npm audit fix --force)
  • ✅ composer audit: 0 active vulnerabilities (1 ignored)

Compatibility

  • ✅ All Composer dependencies compatible with PHP 8.1+
  • ✅ All NPM dependencies compatible with Node 16.20.2 (except esbuild/vite)
  • ✅ Laravel framework compatibility maintained
  • ✅ Filament CMS compatibility maintained

Build Status

  • Note: Build failures expected as this is a Laravel library package
  • Entry files (resources/css/app.css) are provided by consuming applications
  • Security fixes for Composer dependencies apply to all consuming applications

Files Modified

package.json

  • Updated postcss: ^8.4.39 → ^8.5.10
  • Removed explicit rollup dependency (managed by vite)
  • All other dependencies updated via npm audit fix

composer.lock

  • Updated 5 packages with security fixes
  • Resolved pestphp/pest conflict with phpunit/phpunit upgrade

package-lock.json

  • Updated 11+ packages with security fixes
  • All high-severity vulnerabilities resolved

Completed Actions ✅

  • ✅ Deployed Composer security updates (5 packages)
  • ✅ Deployed NPM security updates (8+ packages)
  • ✅ Upgraded Node.js to 20.19.0
  • ✅ Fixed final esbuild/vite vulnerability with npm audit fix --force
Assets 2
Loading