fix: bump postcss-selector-parser from 7.1.1 to 7.1.5 in the npm_and_yarn group across 1 directory - #39
Conversation
Bumps the npm_and_yarn group with 1 update in the / directory: [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser). Updates `postcss-selector-parser` from 7.1.1 to 7.1.5 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.5) --- updated-dependencies: - dependency-name: postcss-selector-parser dependency-version: 7.1.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![warp-factories[bot]](https://avatars.githubusercontent.com/in/2278701?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overview
Bumps the transitive postcss-selector-parser from 7.1.1 to 7.1.5 in package-lock.json only, resolving a known CVE (GHSA-w9m9-85wc-3x92); package.json is untouched and CI is green. No blocking issues found.
Concerns
- The lockfile regeneration also drops
"peer": truefrom ~21 unrelated packages (react, react-dom, next, express, hono, immer, zod, typescript, prisma, @typescript-eslint/eslint-plugin, eslint-plugin-import, acorn, browserslist, @noble/ciphers, @types/react, @types/react-dom, @babel/core, picomatch (both copies), @electric-sql/pglite). None of theirversion/resolved/integrityvalues change, so this looks like npm metadata normalization from the lockfile being regenerated with a different npm version rather than a functional dependency change — flagging for awareness, not blocking.
Verdict
Checks: build n/a (lockfile-only, not exercised), tests n/a (dependency bump, exempt per policy), CI green (all required checks passing), visual proof n/a
Found: 0 critical, 0 important, 1 suggestion, 0 nits
| "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.6.tgz", | ||
| "integrity": "sha512-QdxmAo/ikZqqRGA8s43ww8lcql6naWRvEz0FFrl6MIlc7Gi6TroXnSdWa5U/kq6fzcpqpHesicQxFZIieZbyIA==", | ||
| "license": "MIT", | ||
| "peer": true, |
There was a problem hiding this comment.
This "peer": true removal (and ~20 similar ones across unrelated packages in this file, e.g. react, next, typescript, prisma) looks like npm lockfile metadata churn rather than an intended part of the postcss-selector-parser bump — worth confirming it's a benign side effect of the npm version that regenerated this lockfile.
warp-factories
Bot
added
the
factory:revops-factory
Bumps the npm_and_yarn group with 1 update in the / directory: postcss-selector-parser.
Updates
postcss-selector-parserfrom 7.1.1 to 7.1.5Release notes
Sourced from postcss-selector-parser's releases.
Changelog
Sourced from postcss-selector-parser's changelog.
Commits
e33e9bc7.1.56f4e6c1fix: TypeError on unclosed[,(and trailing|(#330)4d8437ffix: preserve whitespace before a*namespace in attribute selectors (#325)e2f9029fix: don't treat a non-prefix token before|as a namespace (#324)dd50ee1chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)7e3abb2chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)4a7e4e37.1.4e2021c5fix: tolerate non-node children when serializing selectors7893b747.1.35bc698cImprove fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clo...Maintainer changes
This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.