Skip to content

v1.6.4 - Build-time CSS parser patched

Choose a tag to compare

View all tags
@WhiteMuush WhiteMuush released this 26 Oct 15:26
· 29 commits to main since this release
v1.6.4
This tag was signed with the committer’s verified signature.
WhiteMuush Melvin_Petiit
SSH Key Fingerprint: /aDSc/thfZmm6i3zHo9ZoLsFNqEnepgxKUQqrGBcoJw
Verified
Learn about vigilant mode.
e68c4ef
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A dependency patch: the CSS parser used at build time moves to a fixed version.

Upgrading

Nothing to do. There is no migration, and environment variables, port and the Alpine image base are unchanged.

Security

  • postcss-selector-parser 6.1.4 to 6.1.5. This closes GHSA-rj75-hqrm-r3gf (medium), a quadratic parse of flat selectors that could exhaust a CPU. The advisory now has a fix on the 6.x line that tailwindcss 3 accepts.
  • The package only compiles Gardik's own CSS at build time and is not part of the production image, so a running instance was not exposed.
Assets 2
Loading