thibaudcolas / curlylint

Experimental HTML templates linting for Jinja, Nunjucks, Django templates, Twig, Liquid
https://www.curlylint.org/
MIT License
236 stars 25 forks source link

chore(deps): update dependency postcss [security] - autoclosed #134

Closed renovate[bot] closed 1 year ago

renovate[bot] commented 2 years ago

Mend Renovate

This PR contains the following updates:

Package Change
postcss 6.0.23 -> 7.0.36
postcss 8.2.7 -> 8.2.13
postcss 7.0.32 -> 7.0.36

GitHub Vulnerability Alerts

CVE-2021-23382

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/*\s sourceMappingURL=(.).

CVE-2021-23368

The npm package postcss from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

â™» Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.



This PR has been generated by Mend Renovate. View repository job log here.

renovate[bot] commented 1 year ago

âš  Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

â™» Renovate will retry this branch, including artifacts, only when one of the following happens:

The artifact failure details are included below:

File name: website/package-lock.json
npm does not support Node.js v15.14.0
You should probably upgrade to a newer version of node as we
can't make any promises that npm will work with this version.
You can find the latest version at https://nodejs.org/
npm does not support Node.js v15.14.0
You should probably upgrade to a newer version of node as we
can't make any promises that npm will work with this version.
You can find the latest version at https://nodejs.org/
npm notice 
npm notice New major version of npm available! 8.19.4 -> 9.6.2
npm notice Changelog: <https://github.com/npm/cli/releases/tag/v9.6.2>
npm notice Run `npm install -g npm@9.6.2` to update!
npm notice 
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: docusaurus-lunr-search@2.1.10
npm ERR! Found: react@17.0.1
npm ERR! node_modules/react
npm ERR!   react@"17.0.1" from the root project
npm ERR!   peer react@"^16.8.4 || ^17.0.0" from @docusaurus/core@2.0.0-alpha.96e7fcef2
npm ERR!   node_modules/@docusaurus/core
npm ERR!     @docusaurus/core@"2.0.0-alpha.96e7fcef2" from the root project
npm ERR!     peer @docusaurus/core@"^2.0.0-alpha.60 || ^2.0.0" from docusaurus-lunr-search@2.1.10
npm ERR!     node_modules/docusaurus-lunr-search
npm ERR!       docusaurus-lunr-search@"2.1.10" from the root project
npm ERR!   42 more (@docusaurus/react-loadable, ...)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer react@"^16.8.4" from docusaurus-lunr-search@2.1.10
npm ERR! node_modules/docusaurus-lunr-search
npm ERR!   docusaurus-lunr-search@"2.1.10" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: react@16.14.0
npm ERR! node_modules/react
npm ERR!   peer react@"^16.8.4" from docusaurus-lunr-search@2.1.10
npm ERR!   node_modules/docusaurus-lunr-search
npm ERR!     docusaurus-lunr-search@"2.1.10" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate-cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate-cache/others/npm/_logs/2023-03-17T22_01_30_394Z-debug-0.log