Repository navigation
chore(deps-dev): override postcss-selector-parser to 7.1.6 in Tailwind themes - #272
Conversation
…d themes Tailwind 3.4 pins postcss-selector-parser ^6, which has no patched release for GHSA-rj75-hqrm-r3gf. Force 7.1.6 via npm overrides in xtailwind and xtailwind2; the rebuilt styles.css is byte-identical.
Reviewer's guide (collapsed on small PRs)Reviewer's GuideBoth Tailwind themes now override the vulnerable, unpatched postcss-selector-parser 6.x dependency with ^7.1.6, with regenerated lockfiles and verification that the compiled CSS is unchanged. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe xtailwind and xtailwind2 manifests add a ChangesTailwind dependency configuration
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~8 minutes Change: Other Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely identifies the primary change: adding a postcss-selector-parser 7.1.6 override in the Tailwind themes. It matches the main objective of the pull request. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="htdocs/themes/xtailwind2/package.json" line_range="16" />
<code_context>
"tailwindcss": "^3.4.0"
+ },
+ "overrides": {
+ "postcss-selector-parser": "^7.1.6"
}
}
</code_context>
<issue_to_address>
**Regenerated theme loses security override**
When the xtailwind2 generator is rerun, `tools/write_xtailwind2.ps1` overwrites `package.json` without the override, so the next `npm install` can restore the vulnerable parser and the Dependabot alert returns.
Add the override to the generator's manifest template and update the tutorial's install instructions to preserve it.
</issue_to_address>Sourcery assessment
Approval pending. 1 finding to address first.
Blocking findings: htdocs/themes/xtailwind2/package.json:16
| "tailwindcss": "^3.4.0" | ||
| }, | ||
| "overrides": { | ||
| "postcss-selector-parser": "^7.1.6" |
There was a problem hiding this comment.
🟡 Medium · Regenerated theme loses security override
When the xtailwind2 generator is rerun, tools/write_xtailwind2.ps1 overwrites package.json without the override, so the next npm install can restore the vulnerable parser and the Dependabot alert returns.
Add the override to the generator's manifest template and update the tutorial's install instructions to preserve it.
Prompt for AI agents
In `htdocs/themes/xtailwind2/package.json` at line 16:
**Regenerated theme loses security override**
When the xtailwind2 generator is rerun, `tools/write_xtailwind2.ps1` overwrites `package.json` without the override, so the next `npm install` can restore the vulnerable parser and the Dependabot alert returns.
Add the override to the generator's manifest template and update the tutorial's install instructions to preserve it.…ailwind2 generator The generator rewrites package.json, so without this the next run would drop the override and reinstate the vulnerable 6.x parser. Also syncs the typography constraint with the committed manifest.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #272 +/- ##
=========================================
Coverage 22.54% 22.54%
Complexity 8671 8671
=========================================
Files 685 685
Lines 46328 46328
=========================================
Hits 10444 10444
Misses 35884 35884 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Resolves the open Dependabot alert for GHSA-rj75-hqrm-r3gf in the xtailwind and
xtailwind2 themes. Tailwind 3.4 pins postcss-selector-parser ^6, which has no
patched release, so this forces 7.1.6 via npm
overridesin both package.jsonfiles and regenerates the lockfiles.
Both themes were rebuilt with and without the override from the committed
lockfiles; the generated styles.css is byte-identical, so the bump is safe for
the Tailwind 3 toolchain. The committed CSS is unchanged.
Summary by Sourcery
Secure both Tailwind themes by overriding postcss-selector-parser to a patched release.
Bug Fixes:
Enhancements:
Build:
Summary by CodeRabbit