An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
Release Notes
postcss/postcss (postcss)
### [`v8.4.41`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8441)
[Compare Source](https://redirect.github.com/postcss/postcss/compare/8.4.40...8.4.41)
- Fixed types (by [@nex3](https://redirect.github.com/nex3) and [@querkmachine](https://redirect.github.com/querkmachine)).
- Cleaned up RegExps (by [@bluwy](https://redirect.github.com/bluwy)).
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
🧙 Sourcery has finished reviewing your pull request!
Tips
- Trigger a new Sourcery review by commenting `@sourcery-ai review` on the pull request.
- Continue your discussion with Sourcery by replying directly to review comments.
- You can change your review settings at any time by accessing your [dashboard](https://app.sourcery.ai):
- Enable or disable the Sourcery-generated pull request summary or reviewer's guide;
- Change the review language;
- You can always [contact us](mailto:support@sourcery.ai) if you have any questions or feedback.
This PR contains the following updates:
8.4.40
->8.4.41
GitHub Vulnerability Alerts
CVE-2023-44270
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be
\r
discrepancies, as demonstrated by@font-face{ font:(\r/*);}
in a rule.This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
Release Notes
postcss/postcss (postcss)
### [`v8.4.41`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8441) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.4.40...8.4.41) - Fixed types (by [@nex3](https://redirect.github.com/nex3) and [@querkmachine](https://redirect.github.com/querkmachine)). - Cleaned up RegExps (by [@bluwy](https://redirect.github.com/bluwy)).Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.