From 3b7e7ca2127136284f5f643099123245d50c1a63 Mon Sep 17 00:00:00 2001 From: Ned Wolpert Date: Wed, 29 Jul 2026 07:24:12 -0700 Subject: [PATCH 1/2] fix(deps): Update postcss to patch GHSA-r28c-9q8g-f849 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit postcss <= 8.5.17 auto-loads a previous source map from a sourceMappingURL comment without constraining the path, so a crafted stylesheet can read an arbitrary .map file off the build machine (GHSA-r28c-9q8g-f849, high). postcss is a transitive development dependency of tsup and of vite (via vitest), pinned at 8.5.16 in the lockfile. Every dependent range (>=8.0.9, ^8.4.12, ^8.5.16) already admits the patched line, so `npm update postcss` resolves it as a lockfile-only change — no overrides pin and no package.json edit needed. Carries postcss's own nanoid dependency from 3.3.12 to 3.3.16. Verified: 10 test files / 103 tests pass and `npm run build` (tsup ESM + CJS + d.ts) succeeds on the updated tree. Co-Authored-By: Claude Opus 5 (1M context) --- clients/passkeys-browser/package-lock.json | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/clients/passkeys-browser/package-lock.json b/clients/passkeys-browser/package-lock.json index 8cd46c0..3f664d5 100644 --- a/clients/passkeys-browser/package-lock.json +++ b/clients/passkeys-browser/package-lock.json @@ -20,7 +20,7 @@ "vitest": "^4.1.6" }, "engines": { - "node": ">=20" + "node": ">=22.22.2" } }, "node_modules/@asamuzakjp/css-color": { @@ -4356,9 +4356,9 @@ } }, "node_modules/nanoid": { - "version": "3.3.12", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz", - "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==", + "version": "3.3.16", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", + "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", "dev": true, "funding": [ { @@ -4550,9 +4550,9 @@ } }, "node_modules/postcss": { - "version": "8.5.16", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz", - "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==", + "version": "8.5.25", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz", + "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==", "dev": true, "funding": [ { @@ -4570,7 +4570,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.12", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, From ec3e14f4c7783df9bb91665b91e35a23bc85d88e Mon Sep 17 00:00:00 2001 From: Ned Wolpert Date: Wed, 29 Jul 2026 07:27:41 -0700 Subject: [PATCH 2/2] fix(deps): Clear the remaining dev-dependency advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three more advisories against the browser SDK's development tree, all transitive and none reachable from published output: - brace-expansion (high, DoS via unbounded expansion): 5.0.7 -> 5.0.8, resolved in-range by `npm audit fix`. - qs (moderate, GHSA-q8mj-m7cp-5q26 — qs.stringify crashes on null entries in comma-format arrays when encodeValuesOnly is set): reached through @stryker-mutator/core -> typed-rest-client. typed-rest-client pins qs at an exact 6.15.1 (its latest 3.0.0 still does), so audit fix cannot move it — add a `qs: ^6.15.2` override alongside the existing esbuild one, which resolves 6.15.3 and carries side-channel 1.1.0 -> 1.1.1. Drop the override once typed-rest-client picks up a patched qs. `npm audit` is now clean. Verified on a clean `npm ci`: 10 test files / 103 tests pass, tsup builds ESM + CJS + d.ts, and Stryker still resolves. Co-Authored-By: Claude Opus 5 (1M context) --- clients/passkeys-browser/package-lock.json | 27 +++++++++++----------- clients/passkeys-browser/package.json | 3 ++- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/clients/passkeys-browser/package-lock.json b/clients/passkeys-browser/package-lock.json index 3f664d5..05e4ae7 100644 --- a/clients/passkeys-browser/package-lock.json +++ b/clients/passkeys-browser/package-lock.json @@ -2851,16 +2851,16 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/browserslist": { @@ -4658,13 +4658,14 @@ } }, "node_modules/qs": { - "version": "6.15.1", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz", - "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==", + "version": "6.15.3", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", + "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", "dev": true, "license": "BSD-3-Clause", "dependencies": { - "side-channel": "^1.1.0" + "es-define-property": "^1.0.1", + "side-channel": "^1.1.1" }, "engines": { "node": ">=0.6" @@ -4853,15 +4854,15 @@ } }, "node_modules/side-channel": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz", - "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==", + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz", + "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==", "dev": true, "license": "MIT", "dependencies": { "es-errors": "^1.3.0", - "object-inspect": "^1.13.3", - "side-channel-list": "^1.0.0", + "object-inspect": "^1.13.4", + "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" }, diff --git a/clients/passkeys-browser/package.json b/clients/passkeys-browser/package.json index 47df912..6faac74 100644 --- a/clients/passkeys-browser/package.json +++ b/clients/passkeys-browser/package.json @@ -63,6 +63,7 @@ "vitest": "^4.1.6" }, "overrides": { - "esbuild": "^0.28.1" + "esbuild": "^0.28.1", + "qs": "^6.15.2" } }