mirror of
https://github.com/thelounge/thelounge.git
synced 2026-06-21 03:48:33 -04:00
3273cde3fb
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [postcss](https://postcss.org/) ([source](https://redirect.github.com/postcss/postcss)) | [`8.4.47` → `8.5.10`](https://renovatebot.com/diffs/npm/postcss/8.4.47/8.5.10) |  |  | --- ### PostCSS has XSS via Unescaped </style> in its CSS Stringify Output [CVE-2026-41305](https://nvd.nist.gov/vuln/detail/CVE-2026-41305) / [GHSA-qx2v-qp2m-jg93](https://redirect.github.com/advisories/GHSA-qx2v-qp2m-jg93) <details> <summary>More information</summary> #### Details ##### PostCSS: XSS via Unescaped `</style>` in CSS Stringify Output ##### Summary PostCSS v8.5.5 (latest) does not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. ##### Proof of Concept ```javascript const postcss = require('postcss'); // Parse user CSS and re-stringify for page embedding const userCSS = 'body { content: "</style><script>alert(1)</script><style>"; }'; const ast = postcss.parse(userCSS); const output = ast.toResult().css; const html = `<style>${output}</style>`; console.log(html); // <style>body { content: "</style><script>alert(1)</script><style>"; }</style> // // Browser: </style> closes the style tag, <script> executes ``` **Tested output** (Node.js v22, postcss v8.5.5): ``` Input: body { content: "</style><script>alert(1)</script><style>"; } Output: body { content: "</style><script>alert(1)</script><style>"; } Contains </style>: true ``` ##### Impact Impact non-bundler use cases since bundlers for XSS on their own. Requires some PostCSS plugin to have malware code, which can inject XSS to website. ##### Suggested Fix Escape `</style` in all stringified output values: ```javascript output = output.replace(/<\/(style)/gi, '<\\/$1'); ``` ##### Credits Discovered and reported by [Sunil Kumar](https://tharvid.in) ([@​TharVid](https://redirect.github.com/TharVid)) #### Severity - CVSS Score: 6.1 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` #### References - [https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93](https://redirect.github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93) - [https://nvd.nist.gov/vuln/detail/CVE-2026-41305](https://nvd.nist.gov/vuln/detail/CVE-2026-41305) - [https://github.com/postcss/postcss/releases/tag/8.5.10](https://redirect.github.com/postcss/postcss/releases/tag/8.5.10) - [https://github.com/advisories/GHSA-qx2v-qp2m-jg93](https://redirect.github.com/advisories/GHSA-qx2v-qp2m-jg93) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-qx2v-qp2m-jg93) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>postcss/postcss (postcss)</summary> ### [`v8.5.10`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8510) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.9...8.5.10) - Fixed XSS via unescaped `</style>` in non-bundler cases (by [@​TharVid](https://redirect.github.com/TharVid)). ### [`v8.5.9`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#859) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.8...8.5.9) - Speed up source map encoding paring in case of the error. ### [`v8.5.8`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#858) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.7...8.5.8) - Fixed `Processor#version`. ### [`v8.5.7`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#857) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.6...8.5.7) - Improved source map annotation cleaning performance (by CodeAnt AI). ### [`v8.5.6`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#856) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.5...8.5.6) - Fixed `ContainerWithChildren` type discriminating (by [@​Goodwine](https://redirect.github.com/Goodwine)). ### [`v8.5.5`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#855) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.4...8.5.5) - Fixed `package.json`→`exports` compatibility with some tools (by [@​JounQin](https://redirect.github.com/JounQin)). ### [`v8.5.4`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#854) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.3...8.5.4) - Fixed Parcel compatibility issue (by [@​git-sumitchaudhary](https://redirect.github.com/git-sumitchaudhary)). ### [`v8.5.3`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#853) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.2...8.5.3) - Added more details to `Unknown word` error (by [@​hiepxanh](https://redirect.github.com/hiepxanh)). - Fixed types (by [@​romainmenke](https://redirect.github.com/romainmenke)). - Fixed docs (by [@​catnipan](https://redirect.github.com/catnipan)). ### [`v8.5.2`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#852) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.1...8.5.2) - Fixed end position of rules with semicolon (by [@​romainmenke](https://redirect.github.com/romainmenke)). ### [`v8.5.1`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#851) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.0...8.5.1) - Fixed backwards compatibility for complex cases (by [@​romainmenke](https://redirect.github.com/romainmenke)). ### [`v8.5.0`](https://redirect.github.com/postcss/postcss/releases/tag/8.5.0): 8.5 “Duke Alloces” [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.4.49...8.5.0) <img src="https://github.com/user-attachments/assets/6ef654a0-d675-4ba0-a670-e28ef27062f5" align="right" width="200" height="200" alt="President Alloces seal"> PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS. [@​romainmenke](https://redirect.github.com/romainmenke) during [his work](https://redirect.github.com/postcss/postcss/issues/1995) on [Stylelint](https://stylelint.io) added `Input#document` in additional to `Input#css`. ```js root.source.input.document //=> "<p>Hello</p> // <style> // p { // color: green; // } // </style>" root.source.input.css //=> "p { // color: green; // }" ``` #### Thanks to Sponsors This release was possible thanks to our community. If your company wants to support the sustainability of front-end infrastructure or wants to give some love to PostCSS, you can join our supporters by: - [**Tidelift**](https://tidelift.com/) with a Spotify-like subscription model supporting all projects from your lock file. - Direct donations at [**GitHub Sponsors**](https://redirect.github.com/sponsors/ai) or [**Open Collective**](https://opencollective.com/postcss#section-contributors). ### [`v8.4.49`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8449) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.4.48...8.4.49) - Fixed custom syntax without `source.offset` (by [@​romainmenke](https://redirect.github.com/romainmenke)). ### [`v8.4.48`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8448) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.4.47...8.4.48) - Fixed position calculation in error/warnings methods (by [@​romainmenke](https://redirect.github.com/romainmenke)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/thelounge/thelounge). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTguMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbIlR5cGU6IFNlY3VyaXR5Il19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
145 lines
4.2 KiB
JSON
145 lines
4.2 KiB
JSON
{
|
|
"name": "thelounge",
|
|
"description": "The self-hosted Web IRC client",
|
|
"version": "4.5.1-pre.1",
|
|
"type": "commonjs",
|
|
"preferGlobal": true,
|
|
"bin": {
|
|
"thelounge": "index.js"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/thelounge/thelounge.git"
|
|
},
|
|
"homepage": "https://thelounge.chat/",
|
|
"scripts": {
|
|
"build:client": "vite build",
|
|
"build:server": "tsc -p server/tsconfig.json",
|
|
"build": "run-p --aggregate-output build:client build:server",
|
|
"coverage": "vitest run --coverage",
|
|
"dev": "cross-env NODE_ENV=development ts-node --project server/tsconfig.json server/index.ts start --dev",
|
|
"format:prettier": "prettier --write \"**/*.*\"",
|
|
"generate:config:doc": "ts-node scripts/generate-config-doc.js",
|
|
"lint:check-eslint": "eslint-config-prettier .eslintrc.cjs",
|
|
"lint:eslint": "eslint . --report-unused-disable-directives --color",
|
|
"lint:prettier": "prettier --list-different \"**/*.*\"",
|
|
"lint:stylelint": "stylelint --color \"client/**/*.css\"",
|
|
"lint": "run-p --aggregate-output --continue-on-error lint:*",
|
|
"start": "node index start",
|
|
"test": "run-p --aggregate-output --continue-on-error lint:* test:vitest",
|
|
"test:vitest": "vitest run",
|
|
"watch": "vite build --watch",
|
|
"githooks-install": "git config core.hooksPath scripts/git-hooks"
|
|
},
|
|
"keywords": [
|
|
"lounge",
|
|
"browser",
|
|
"web",
|
|
"chat",
|
|
"client",
|
|
"irc",
|
|
"server",
|
|
"thelounge"
|
|
],
|
|
"license": "MIT",
|
|
"engines": {
|
|
"node": ">=22.0.0"
|
|
},
|
|
"files": [
|
|
"./.thelounge_home",
|
|
"./index.js",
|
|
"./yarn.lock",
|
|
"./dist/package.json",
|
|
"./dist/**/*.js",
|
|
"./public/**"
|
|
],
|
|
"dependencies": {
|
|
"@fastify/busboy": "1.0.0",
|
|
"bcryptjs": "2.4.3",
|
|
"chalk": "4.1.2",
|
|
"cheerio": "1.0.0",
|
|
"commander": "9.0.0",
|
|
"content-disposition": "0.5.4",
|
|
"express": "4.20.0",
|
|
"file-type": "16.5.4",
|
|
"filenamify": "4.3.0",
|
|
"got": "11.8.6",
|
|
"irc-framework": "github:kiwiirc/irc-framework#9578e59",
|
|
"ldapjs": "2.3.3",
|
|
"linkify-it": "3.0.3",
|
|
"lodash": "4.17.21",
|
|
"mime-types": "2.1.35",
|
|
"node-forge": "1.3.1",
|
|
"package-json": "7.0.0",
|
|
"read": "1.0.7",
|
|
"semver": "7.5.2",
|
|
"socket.io": "4.6.2",
|
|
"tlds": "1.228.0",
|
|
"ua-parser-js": "1.0.39",
|
|
"web-push": "3.4.5",
|
|
"yarn": "1.22.22"
|
|
},
|
|
"devDependencies": {
|
|
"@fortawesome/fontawesome-free": "5.15.4",
|
|
"@textcomplete/core": "0.1.10",
|
|
"@textcomplete/textarea": "0.1.10",
|
|
"@types/bcryptjs": "2.4.6",
|
|
"@types/cheerio": "0.22.35",
|
|
"@types/content-disposition": "0.5.8",
|
|
"@types/express": "4.17.21",
|
|
"@types/ldapjs": "2.2.5",
|
|
"@types/linkify-it": "3.0.5",
|
|
"@types/lodash": "4.14.202",
|
|
"@types/mime-types": "2.1.4",
|
|
"@types/mousetrap": "1.6.15",
|
|
"@types/node": "22.19.17",
|
|
"@types/read": "0.0.32",
|
|
"@types/semver": "7.3.9",
|
|
"@types/sortablejs": "1.15.8",
|
|
"@types/ua-parser-js": "0.7.39",
|
|
"@types/web-push": "3.3.2",
|
|
"@types/ws": "8.5.12",
|
|
"@typescript-eslint/eslint-plugin": "7.8.0",
|
|
"@typescript-eslint/parser": "7.8.0",
|
|
"@vitejs/plugin-vue": "6.0.5",
|
|
"@vitest/coverage-istanbul": "4.1.4",
|
|
"@vue/runtime-dom": "3.2.33",
|
|
"@vue/test-utils": "2.4.6",
|
|
"cross-env": "7.0.3",
|
|
"cssnano": "5.0.17",
|
|
"dayjs": "1.10.8",
|
|
"emoji-regex": "10.2.1",
|
|
"eslint": "8.57.0",
|
|
"eslint-config-prettier": "9.1.0",
|
|
"eslint-define-config": "2.1.0",
|
|
"eslint-plugin-vue": "9.25.0",
|
|
"fuzzy": "0.1.3",
|
|
"jsdom": "29.0.2",
|
|
"mousetrap": "1.6.5",
|
|
"normalize.css": "8.0.1",
|
|
"npm-run-all2": "5.0.0",
|
|
"postcss": "8.5.10",
|
|
"postcss-import": "14.0.2",
|
|
"postcss-preset-env": "7.3.0",
|
|
"prettier": "2.5.1",
|
|
"pretty-quick": "3.1.3",
|
|
"primer-tooltips": "2.0.0",
|
|
"sinon": "13.0.2",
|
|
"socket.io-client": "4.5.0",
|
|
"sortablejs": "1.15.2",
|
|
"stylelint": "14.3.0",
|
|
"stylelint-config-standard": "24.0.0",
|
|
"ts-node": "10.7.0",
|
|
"ts-sinon": "2.0.2",
|
|
"tsx": "4.21.0",
|
|
"typescript": "5.4.5",
|
|
"undate": "0.3.0",
|
|
"vite": "8.0.16",
|
|
"vitest": "4.1.4",
|
|
"vue": "3.2.35",
|
|
"vue-eslint-parser": "9.4.3",
|
|
"vue-router": "4.0.15",
|
|
"vuex": "4.0.2"
|
|
}
|
|
}
|