From bfc381f6b31de33812841ce7460d9c00866c58d7 Mon Sep 17 00:00:00 2001 From: Michael Beck Date: Thu, 15 Oct 2026 21:49:03 -0400 Subject: [PATCH 1/2] chore(deps-dev): override postcss-selector-parser to 7.1.6 in Tailwind themes Tailwind 3.4 pins postcss-selector-parser ^6, which has no patched release for GHSA-rj75-hqrm-r3gf. Force 7.1.6 via npm overrides in xtailwind and xtailwind2; the rebuilt styles.css is byte-identical. --- htdocs/themes/xtailwind/package-lock.json | 34 ++----------------- htdocs/themes/xtailwind/package.json | 3 ++ htdocs/themes/xtailwind2/package-lock.json | 38 +++------------------- htdocs/themes/xtailwind2/package.json | 3 ++ 4 files changed, 14 insertions(+), 64 deletions(-) diff --git a/htdocs/themes/xtailwind/package-lock.json b/htdocs/themes/xtailwind/package-lock.json index 7bf42091d..85753f970 100644 --- a/htdocs/themes/xtailwind/package-lock.json +++ b/htdocs/themes/xtailwind/package-lock.json @@ -773,24 +773,10 @@ "postcss": "^8.2.14" } }, - "node_modules/postcss-nested/node_modules/postcss-selector-parser": { - "version": "6.1.4", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", - "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-selector-parser": { - "version": "6.0.10", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.10.tgz", - "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==", + "version": "7.1.6", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", + "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", "dev": true, "license": "MIT", "dependencies": { @@ -992,20 +978,6 @@ "node": ">=14.0.0" } }, - "node_modules/tailwindcss/node_modules/postcss-selector-parser": { - "version": "6.1.4", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", - "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/thenify": { "version": "3.3.1", "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz", diff --git a/htdocs/themes/xtailwind/package.json b/htdocs/themes/xtailwind/package.json index 08efa0518..c7a9fb3aa 100644 --- a/htdocs/themes/xtailwind/package.json +++ b/htdocs/themes/xtailwind/package.json @@ -11,5 +11,8 @@ "@tailwindcss/typography": "^0.5.20", "daisyui": "^4.12.0", "tailwindcss": "^3.4.0" + }, + "overrides": { + "postcss-selector-parser": "^7.1.6" } } diff --git a/htdocs/themes/xtailwind2/package-lock.json b/htdocs/themes/xtailwind2/package-lock.json index fc13dcc0a..f1c926091 100644 --- a/htdocs/themes/xtailwind2/package-lock.json +++ b/htdocs/themes/xtailwind2/package-lock.json @@ -1,11 +1,11 @@ { - "name": "xtailwind", + "name": "xtailwind2", "version": "0.2.0", "lockfileVersion": 3, "requires": true, "packages": { "": { - "name": "xtailwind", + "name": "xtailwind2", "version": "0.2.0", "devDependencies": { "@tailwindcss/typography": "^0.5.20", @@ -773,24 +773,10 @@ "postcss": "^8.2.14" } }, - "node_modules/postcss-nested/node_modules/postcss-selector-parser": { - "version": "6.1.4", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", - "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-selector-parser": { - "version": "6.0.10", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.10.tgz", - "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==", + "version": "7.1.6", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", + "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", "dev": true, "license": "MIT", "dependencies": { @@ -992,20 +978,6 @@ "node": ">=14.0.0" } }, - "node_modules/tailwindcss/node_modules/postcss-selector-parser": { - "version": "6.1.4", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", - "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/thenify": { "version": "3.3.1", "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz", diff --git a/htdocs/themes/xtailwind2/package.json b/htdocs/themes/xtailwind2/package.json index 9614be1ca..8bff06b69 100644 --- a/htdocs/themes/xtailwind2/package.json +++ b/htdocs/themes/xtailwind2/package.json @@ -11,5 +11,8 @@ "@tailwindcss/typography": "^0.5.20", "daisyui": "^4.12.0", "tailwindcss": "^3.4.0" + }, + "overrides": { + "postcss-selector-parser": "^7.1.6" } } From a25c6da90dfaad1cabcc64b765f280d8ca3771b9 Mon Sep 17 00:00:00 2001 From: Michael Beck Date: Fri, 16 Oct 2026 03:13:44 -0400 Subject: [PATCH 2/2] chore(themes): carry the postcss-selector-parser override into the xtailwind2 generator The generator rewrites package.json, so without this the next run would drop the override and reinstate the vulnerable 6.x parser. Also syncs the typography constraint with the committed manifest. --- tools/write_xtailwind2.ps1 | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/write_xtailwind2.ps1 b/tools/write_xtailwind2.ps1 index 0c80b79d3..ac8c3913c 100644 --- a/tools/write_xtailwind2.ps1 +++ b/tools/write_xtailwind2.ps1 @@ -11,9 +11,12 @@ $base = 'C:\wamp64\www\2512menus\themes\xtailwind2' "watch": "tailwindcss -i ./css/input.css -o ./css/styles.css --watch" }, "devDependencies": { - "@tailwindcss/typography": "^0.5.10", + "@tailwindcss/typography": "^0.5.20", "daisyui": "^4.12.0", "tailwindcss": "^3.4.0" + }, + "overrides": { + "postcss-selector-parser": "^7.1.6" } } '@ | Set-Content -Path (Join-Path $base 'package.json') -Encoding UTF8