maximus/simpl-liste
1
0
Fork 0
Code Issues 4 Pull requests Projects Releases 20 Packages Wiki Activity Actions

fix(security): add http-cache-semantics and postcss-selector-parser floors

Browse source 
- http-cache-semantics ^4.3.0 (GHSA-ch52-4w7c-c8xp, high): 4.3.0 is out of
  the <=4.2.0 range although the advisory lists no patched version. Single
  copy via @expo/ngrok > got > cacheable-request (^4.0.0), dev tunnel only.
- postcss-selector-parser@^6.0.0 -> ^6.1.3 (GHSA-w9m9-85wc-3x92, low),
  version-scoped to the tailwindcss@3 major. Resolves to 6.1.4.

Lockfile: two stanzas, package count unchanged (2084). npm audit 33 -> 31.
Android JS bundle (expo export --no-bytecode, cache cleared) is byte-identical
before and after. Smoke test guards both floors.

Resolves #128
Resolves #129

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
le king fu 2026-10-05 19:27:33 -04:00
parent 84048e976c
commit 62efdba22e
3 changed files with 37 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
package-lock.json generated
View file

@ -7068,9 +7068,9 @@
}
},
"node_modules/http-cache-semantics": {
"version": "4.2.0",
"resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
"integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
"version": "4.3.0",
"resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz",
"integrity": "sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==",
"license": "BSD-2-Clause"
},
"node_modules/http-errors": {
@ -9682,9 +9682,9 @@
}
},
"node_modules/postcss-selector-parser": {
"version": "6.1.2",
"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.2.tgz",
"integrity": "sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==",
"version": "6.1.4",
"resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
"integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
"license": "MIT",
"dependencies": {
"cssesc": "^3.0.0",

2
package.json
View file

@ -71,6 +71,8 @@
"@xmldom/xmldom": "^0.8.15",
"uuid": "^11.1.1",
"postcss": "^8.5.18",
"postcss-selector-parser@^6.0.0": "^6.1.3",
"http-cache-semantics": "^4.3.0",
"js-yaml@^3.0.0": "^3.15.2",
"js-yaml@^4.0.0": "^4.3.2",
"brace-expansion@^1.0.0": "^1.1.21",

29
tests/smoke.test.cjs
View file

@ -306,6 +306,35 @@ check('every installed undici copy is >= 6.28.1', () => {
);
});
// --- Override floors (#128, #129) ---
// http-cache-semantics: blanket floor, a single copy (@expo/ngrok > got).
// postcss-selector-parser: version-scoped to major 6 (tailwindcss@3 pipeline);
// any other major is unexpected and must fail loudly.
check('every installed http-cache-semantics copy is >= 4.3.0', () => {
const copies = installedCopies('http-cache-semantics');
assert.ok(copies.length > 0, 'http-cache-semantics is not installed');
const strays = copies.filter((c) => !versionAtLeast(c.version, '4.3.0'));
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'http-cache-semantics must be >= 4.3.0'
);
});
check('every installed postcss-selector-parser copy is 6.x and >= 6.1.3', () => {
const copies = installedCopies('postcss-selector-parser');
assert.ok(copies.length > 0, 'postcss-selector-parser is not installed');
const strays = copies.filter(
(c) => majorOf(c.version) !== '6' || !versionAtLeast(c.version, '6.1.3')
);
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'postcss-selector-parser must be 6.x >= 6.1.3'
);
});
// The call that broke under the blanket override: each minimatch copy must
// still expand braces through its own brace-expansion major.
check('every installed minimatch copy still matches globs and braces', () => {