From 47cbefad5e95451678a4fe7a256097598d0e32ec Mon Sep 17 00:00:00 2001 From: Michael Haschke Date: Mon, 17 Aug 2026 12:11:27 +0200 Subject: [PATCH 1/7] fis high ecurity issues for js-yaml library --- package.json | 5 ++++- yarn.lock | 23 ++++++++--------------- 2 files changed, 12 insertions(+), 16 deletions(-) diff --git a/package.json b/package.json index 66e33de9..5ab7a743 100644 --- a/package.json +++ b/package.json @@ -185,7 +185,10 @@ "**/lodash": "^4.18.1", "**/minimatch": "^3.1.4", "**/serialize-javascript": "^7.0.5", - "**/ws": "^8.21.0" + "**/ws": "^8.21.0", + "babel-jest/**/js-yaml": "^3.15.1", + "stylelint/**/js-yaml": "^4.3.1", + "@eslint/eslintrc/**/js-yaml": "^4.3.1" }, "husky": { "hooks": { diff --git a/yarn.lock b/yarn.lock index 9d1e1a2a..1d3af839 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8269,25 +8269,18 @@ jest@^30.4.2: resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499" integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ== -js-yaml@^3.13.1: - version "3.14.1" - resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.14.1.tgz#dae812fdb3825fa306609a8717383c50c36a0537" - integrity sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g== +js-yaml@^3.13.1, js-yaml@^3.15.1: + version "3.15.1" + resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.15.1.tgz#24bc95028f361cdaaa84745b06a109c4486773c0" + integrity sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag== dependencies: argparse "^1.0.7" esprima "^4.0.0" -js-yaml@^4.1.0: - version "4.1.0" - resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.1.0.tgz#c1fb65f8f5017901cdd2c951864ba18458a10602" - integrity sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA== - dependencies: - argparse "^2.0.1" - -js-yaml@^4.1.1: - version "4.1.1" - resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.1.1.tgz#854c292467705b699476e1a2decc0c8a3458806b" - integrity sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA== +js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.3.1: + version "4.3.1" + resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.1.tgz#01216c001d67f48e2cd560d708c7af21090a3848" + integrity sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ== dependencies: argparse "^2.0.1" From 839984ee4ce8a5243d1f8eaeacccddb249f0a580 Mon Sep 17 00:00:00 2001 From: Michael Haschke Date: Mon, 17 Aug 2026 12:22:09 +0200 Subject: [PATCH 2/7] fix high ecurity issues for nanoid library --- package.json | 3 ++- yarn.lock | 13 ++++--------- 2 files changed, 6 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index 5ab7a743..87cd2696 100644 --- a/package.json +++ b/package.json @@ -188,7 +188,8 @@ "**/ws": "^8.21.0", "babel-jest/**/js-yaml": "^3.15.1", "stylelint/**/js-yaml": "^4.3.1", - "@eslint/eslintrc/**/js-yaml": "^4.3.1" + "@eslint/eslintrc/**/js-yaml": "^4.3.1", + "**/nanoid": "^3.3.18" }, "husky": { "hooks": { diff --git a/yarn.lock b/yarn.lock index 1d3af839..81b658ab 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9268,15 +9268,10 @@ n3@^1.26.0: buffer "^6.0.3" readable-stream "^4.0.0" -nanoid@^3.3.11: - version "3.3.11" - resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.11.tgz#4f4f112cefbe303202f2199838128936266d185b" - integrity sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w== - -nanoid@^3.3.12: - version "3.3.12" - resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.12.tgz#ab3d912e217a6d0a514f00a72a16543a28982c05" - integrity sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ== +nanoid@^3.3.11, nanoid@^3.3.12, nanoid@^3.3.18: + version "3.3.18" + resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.18.tgz#f66a2de1199ffde0fcf21c8a5f13106b1c081913" + integrity sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w== napi-postinstall@^0.3.0: version "0.3.2" From 8bcf4a518511d8556ad0046f2a443348bec7fc42 Mon Sep 17 00:00:00 2001 From: Michael Haschke Date: Mon, 17 Aug 2026 12:36:39 +0200 Subject: [PATCH 3/7] fix high ecurity issues for fast-uri library --- package.json | 3 ++- yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 87cd2696..f793fbe1 100644 --- a/package.json +++ b/package.json @@ -189,7 +189,8 @@ "babel-jest/**/js-yaml": "^3.15.1", "stylelint/**/js-yaml": "^4.3.1", "@eslint/eslintrc/**/js-yaml": "^4.3.1", - "**/nanoid": "^3.3.18" + "**/nanoid": "^3.3.18", + "**/fast-uri": "^3.1.3" }, "husky": { "hooks": { diff --git a/yarn.lock b/yarn.lock index 81b658ab..ebcea458 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6406,10 +6406,10 @@ fast-levenshtein@^2.0.6: resolved "https://registry.yarnpkg.com/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz#3d8a5c66883a16a30ca8643e851f19baa7797917" integrity sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw== -fast-uri@^3.0.1: - version "3.1.2" - resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.2.tgz#8af3d4fc9d3e71b11572cc2673b514a7d1a8c8ec" - integrity sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ== +fast-uri@^3.0.1, fast-uri@^3.1.3: + version "3.1.5" + resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.5.tgz#610f37419a030270430cecd68d74e3d4d96725d0" + integrity sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw== fastest-levenshtein@^1.0.16: version "1.0.16" From 5e6cb727b264c64469ed80612e6a40128436eb27 Mon Sep 17 00:00:00 2001 From: Michael Haschke Date: Mon, 17 Aug 2026 12:52:54 +0200 Subject: [PATCH 4/7] fix high security issues for immutable library --- package.json | 3 ++- yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index f793fbe1..52808268 100644 --- a/package.json +++ b/package.json @@ -190,7 +190,8 @@ "stylelint/**/js-yaml": "^4.3.1", "@eslint/eslintrc/**/js-yaml": "^4.3.1", "**/nanoid": "^3.3.18", - "**/fast-uri": "^3.1.3" + "**/fast-uri": "^3.1.3", + "sass/**/immutable": "^5.1.8" }, "husky": { "hooks": { diff --git a/yarn.lock b/yarn.lock index ebcea458..1517cb78 100644 --- a/yarn.lock +++ b/yarn.lock @@ -7349,10 +7349,10 @@ ignore@^7.0.5: resolved "https://registry.yarnpkg.com/ignore/-/ignore-7.0.5.tgz#4cb5f6cd7d4c7ab0365738c7aea888baa6d7efd9" integrity sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg== -immutable@^5.1.5: - version "5.1.5" - resolved "https://registry.yarnpkg.com/immutable/-/immutable-5.1.5.tgz#93ee4db5c2a9ab42a4a783069f3c5d8847d40165" - integrity sha512-t7xcm2siw+hlUM68I+UEOK+z84RzmN59as9DZ7P1l0994DKUWV7UXBMQZVxaoMSRQ+PBZbHCOoBt7a2wxOMt+A== +immutable@^5.1.5, immutable@^5.1.8: + version "5.1.9" + resolved "https://registry.yarnpkg.com/immutable/-/immutable-5.1.9.tgz#ac23c3a01992ab665e14ac9ffff298f28cd74a0c" + integrity sha512-m8nVez3rwrgmWxtLMt1ZYXB2Lv7OKYn/disyxAlSDYAlKSlFoPPfIAmAM/M5xqL4m4C/wAPw7S2/CNaUii1Hxg== import-fresh@^3.2.1, import-fresh@^3.3.0: version "3.3.1" From c0cf88ca920870925b43f09526d057f38bc407f2 Mon Sep 17 00:00:00 2001 From: Michael Haschke Date: Mon, 17 Aug 2026 13:41:33 +0200 Subject: [PATCH 5/7] fix high security issues for brace-expansion library --- package.json | 3 ++- yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 52808268..1bb0153d 100644 --- a/package.json +++ b/package.json @@ -191,7 +191,8 @@ "@eslint/eslintrc/**/js-yaml": "^4.3.1", "**/nanoid": "^3.3.18", "**/fast-uri": "^3.1.3", - "sass/**/immutable": "^5.1.8" + "sass/**/immutable": "^5.1.8", + "**/brace-expansion": "^1.1.18" }, "husky": { "hooks": { diff --git a/yarn.lock b/yarn.lock index 1517cb78..c8af7f7f 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4770,10 +4770,10 @@ boolbase@^1.0.0: resolved "https://registry.yarnpkg.com/boolbase/-/boolbase-1.0.0.tgz#68dff5fbe60c51eb37725ea9e3ed310dcc1e776e" integrity sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww== -brace-expansion@^1.1.7: - version "1.1.13" - resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.13.tgz#d37875c01dc9eff988dd49d112a57cb67b54efe6" - integrity sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w== +brace-expansion@^1.1.18, brace-expansion@^1.1.7: + version "1.1.18" + resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.18.tgz#3ce74d89885136be1535341f8c3d4425c29a5cab" + integrity sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw== dependencies: balanced-match "^1.0.0" concat-map "0.0.1" From 5316ec535a514d147e5952b027a3eb16734af786 Mon Sep 17 00:00:00 2001 From: Michael Haschke Date: Mon, 17 Aug 2026 14:01:24 +0200 Subject: [PATCH 6/7] fix high security issues for postcss library used with stylelint packages --- package.json | 2 ++ yarn.lock | 14 +++++++------- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 1bb0153d..999aedd1 100644 --- a/package.json +++ b/package.json @@ -181,6 +181,8 @@ "resolutions": { "**/@blueprintjs/core": "6.8.1", "node-sass-package-importer/**/postcss": "^8.5.10", + "stylelint-order/**/postcss": "^8.5.12", + "stylelint/**/postcss": "^8.5.18", "hast-util-from-parse5": "8.0.0", "**/lodash": "^4.18.1", "**/minimatch": "^3.1.4", diff --git a/yarn.lock b/yarn.lock index c8af7f7f..f2e5e237 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9268,7 +9268,7 @@ n3@^1.26.0: buffer "^6.0.3" readable-stream "^4.0.0" -nanoid@^3.3.11, nanoid@^3.3.12, nanoid@^3.3.18: +nanoid@^3.3.11, nanoid@^3.3.12, nanoid@^3.3.17, nanoid@^3.3.18: version "3.3.18" resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.18.tgz#f66a2de1199ffde0fcf21c8a5f13106b1c081913" integrity sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w== @@ -9931,7 +9931,7 @@ postcss@^6.0.14, postcss@^8.2.7, postcss@^8.5.10: picocolors "^1.1.1" source-map-js "^1.2.1" -postcss@^8.4.40, postcss@^8.5.13: +postcss@^8.4.40: version "8.5.14" resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.14.tgz#a66c2d7808fadf69ebb5b84a03f8bafd76c4919c" integrity sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg== @@ -9940,12 +9940,12 @@ postcss@^8.4.40, postcss@^8.5.13: picocolors "^1.1.1" source-map-js "^1.2.1" -postcss@^8.5.8: - version "8.5.8" - resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.8.tgz#6230ecc8fb02e7a0f6982e53990937857e13f399" - integrity sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg== +postcss@^8.5.12, postcss@^8.5.13, postcss@^8.5.18, postcss@^8.5.8: + version "8.5.26" + resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.26.tgz#6e75135780c7e10df3433bf2266c552d35c8c620" + integrity sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ== dependencies: - nanoid "^3.3.11" + nanoid "^3.3.17" picocolors "^1.1.1" source-map-js "^1.2.1" From 1d37cfe7c2bc9eb7dbb84506116ab2a53220c0fb Mon Sep 17 00:00:00 2001 From: Michael Haschke Date: Mon, 17 Aug 2026 14:52:27 +0200 Subject: [PATCH 7/7] fix high security issues for postcss library --- package.json | 2 +- yarn.lock | 21 ++++++--------------- 2 files changed, 7 insertions(+), 16 deletions(-) diff --git a/package.json b/package.json index 999aedd1..51c9caa6 100644 --- a/package.json +++ b/package.json @@ -180,7 +180,7 @@ }, "resolutions": { "**/@blueprintjs/core": "6.8.1", - "node-sass-package-importer/**/postcss": "^8.5.10", + "node-sass-package-importer/**/postcss": "^8.5.18", "stylelint-order/**/postcss": "^8.5.12", "stylelint/**/postcss": "^8.5.18", "hast-util-from-parse5": "8.0.0", diff --git a/yarn.lock b/yarn.lock index f2e5e237..c0f579f3 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9268,7 +9268,7 @@ n3@^1.26.0: buffer "^6.0.3" readable-stream "^4.0.0" -nanoid@^3.3.11, nanoid@^3.3.12, nanoid@^3.3.17, nanoid@^3.3.18: +nanoid@^3.3.11, nanoid@^3.3.17, nanoid@^3.3.18: version "3.3.18" resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.18.tgz#f66a2de1199ffde0fcf21c8a5f13106b1c081913" integrity sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w== @@ -9922,12 +9922,12 @@ postcss-value-parser@^4.1.0, postcss-value-parser@^4.2.0: resolved "https://registry.yarnpkg.com/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz#723c09920836ba6d3e5af019f92bc0971c02e514" integrity sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ== -postcss@^6.0.14, postcss@^8.2.7, postcss@^8.5.10: - version "8.5.15" - resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.15.tgz#d1eaf677a324e9ec02196da2d3fecf4a0b9a735c" - integrity sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A== +postcss@^6.0.14, postcss@^8.2.7, postcss@^8.5.12, postcss@^8.5.13, postcss@^8.5.18, postcss@^8.5.8: + version "8.5.26" + resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.26.tgz#6e75135780c7e10df3433bf2266c552d35c8c620" + integrity sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ== dependencies: - nanoid "^3.3.12" + nanoid "^3.3.17" picocolors "^1.1.1" source-map-js "^1.2.1" @@ -9940,15 +9940,6 @@ postcss@^8.4.40: picocolors "^1.1.1" source-map-js "^1.2.1" -postcss@^8.5.12, postcss@^8.5.13, postcss@^8.5.18, postcss@^8.5.8: - version "8.5.26" - resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.26.tgz#6e75135780c7e10df3433bf2266c552d35c8c620" - integrity sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ== - dependencies: - nanoid "^3.3.17" - picocolors "^1.1.1" - source-map-js "^1.2.1" - prelude-ls@^1.2.1: version "1.2.1" resolved "https://registry.yarnpkg.com/prelude-ls/-/prelude-ls-1.2.1.tgz#debc6489d7a6e6b0e7611888cec880337d316396"