fix(security): force postcss >= 8.5.12 via scoped resolution (dependabot #236) - #769
Merged
Conversation
…via scoped resolution Resolves https://github.com/aws-amplify/amplify-data/security/dependabot/236 (GHSA-6g55-p6wh-862q / CVE-2026-45623, high). next@16.2.6 exact-pins postcss@8.4.31, which Dependabot cannot auto-fix; the scoped "next/postcss" resolution follows the repo precedent of #765 (next/sharp) and leaves the already-safe postcss@^8.5.15 entry untouched.
|
soberm
previously approved these changes
Jul 31, 2026
The lockfile was hand-edited rather than regenerated, leaving it in a form yarn never emits: a duplicate "nanoid@npm:^3.3.16" entry and two separate "postcss@npm:^8.5.12" / "postcss@npm:^8.5.15" entries that both resolve to 8.5.23. Yarn merges descriptors sharing a resolution into one key, so `yarn install --immutable` failed with YN0028 and blocked prebuild. Regenerated with yarn 4.13.0 on node 24; no dependency versions change.
…ndabot-236 # Conflicts: # package.json
osama-rizk
approved these changes
Jul 31, 2026
soberm
approved these changes
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security fix
Resolves Dependabot alert #236 (high severity): https://github.com/aws-amplify/amplify-data/security/dependabot/236
Finding: postcss — Arbitrary file read and information disclosure via attacker-controlled
sourceMappingURLin CSS comments (CVE-2026-45623, GHSA-6g55-p6wh-862q). Vulnerable range:<= 8.5.11; first patched:8.5.12. Transitive dev dependency in the rootyarn.lock.Why Dependabot can't auto-fix: the vulnerable
postcss@8.4.31enters vianext@16.2.6, which pins it exactly (npm:8.4.31), so a plain upgrade won't help.Fix
package.json:"next/postcss": "^8.5.12"— following the repo's existing scoped-resolution precedent (e.g.next/sharpfrom fix(security): force sharp >=0.35.0 via next/sharp resolution (dependabot #231) #765). No other resolutions touched.yarn.lockviayarn install: the vulnerablepostcss@npm:8.4.31entry is replaced bypostcss@npm:^8.5.12→ 8.5.23. The already-safe vite-sidepostcss@^8.5.15entry is untouched.Verification
yarn why postcssshows only 8.5.23 (next) and 8.5.15 (vite) — no version<= 8.5.11remains anywhere inyarn.lock.yarn build✅,yarn lint✅,yarn check:api✅,yarn test:scripts✅ (4/4); unit tests: 540 passed. (9 integration-test suites fail locally with a pre-existing environment error —TS2304: Cannot find name '__filename'— reproduced identically on an unmodifiedorigin/mainbaseline; unrelated to this change.)