chore: upgrade postcss-selector-parser to ^6.1.4 to address CVE-2026-9358 - #1625
Merged
Conversation
This comment has been minimized.
This comment has been minimized.
Contributor
License Audit
Weak Copyleft Packages (informational)
Resolved Packages (26)
|
…9358 Refreshes the ^6.1.1/^6.1.2 lockfile entries and adds a qualified resolution for the exact 6.0.10 pin that @tailwindcss/typography requests, which no published version of that plugin has relaxed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
jsourcebot
force-pushed
the
cursor/cve/postcss-selector-parser
branch
from
September 4, 2026 04:14
46e0772 to
cb48939
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes SOU-2117
Summary
Moves every
postcss-selector-parserinstance in the dependency graph to6.1.4, at or above the6.1.3patched floor.Two distinct requesters were pulling vulnerable versions:
tailwindcss@3.4.17(^6.1.2) andpostcss-nested@6.2.0(^6.1.1) resolved to6.1.2. Those ranges already admitted the patched release, so ayarn up -R postcss-selector-parserlockfile refresh was sufficient.@tailwindcss/typographyrequestspostcss-selector-parserat the exact version6.0.10. Every published release of that plugin up to and including the current0.5.20still pins6.0.10, so no top-level upgrade can relax it. This required the narrowest available fallback: a qualifiedresolutionsentry keyed to the existing source range.Advisory addressed
postcss-selector-parserallows denial of service through uncontrolled AST recursion intoString(src/selectors/container.js). Patched in6.1.3/7.1.1.Verification
yarn why postcss-selector-parserreports6.1.4for all five requester paths — no vulnerable version remains in the dependency graph.yarn install --immutablesucceeds.yarn testpasses: 1439 web tests across 139 files, plus thequeryLanguage,shared, andbackendsuites.yarn buildsucceeds for all workspaces, including the Next.js production build. This exercises the affected code path directly, since Tailwind,postcss-nested, and the typography plugin all runpostcss-selector-parserduring CSS compilation.🤖 Generated with Claude Code
Note
Low Risk
Dependency-only security patch with no application code changes; risk is limited to CSS/PostCSS build-time behavior from the upgraded parser.
Overview
Security dependency bump for CVE-2026-9358 (DoS via uncontrolled AST recursion in
postcss-selector-parser’stoString).The lockfile is refreshed so transitive consumers (
tailwindcss,postcss-nested, etc.) resolvepostcss-selector-parser@6.1.4instead of 6.1.2 / 6.0.10. Because@tailwindcss/typographypins the exact 6.0.10 range, the rootpackage.jsonadds a Yarnresolutionsoverride (postcss-selector-parser@npm:6.0.10→^6.1.3) so that path is forced onto a patched release too.CHANGELOG records the upgrade under [Unreleased] → Fixed.
Reviewed by Cursor Bugbot for commit cb48939. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by cubic
Upgrades every
postcss-selector-parserinstance to 6.1.4, closing CVE-2026-9358 (denial of service via AST recursion), and records the change in the changelog.Dependencies
tailwindcssandpostcss-nestedranges already admit the patched release, so a lockfile refresh resolves them to 6.1.4.@tailwindcss/typographypinspostcss-selector-parserat exactly 6.0.10, so a qualifiedresolutionsentry forces that range to^6.1.3.Written for commit cb48939. Summary will update on new commits.