Update postcss-selector-parser to v7.1.6 by NickBevers · Pull Request #429 · tailwindlabs/tailwindcss-typography

NickBevers · 2026-10-06T07:59:38Z

postcss-selector-parser 6.0.10 is affected by GHSA-rj75-hqrm-r3gf, which is fixed in 7.1.6. Because the plugin pins 6.0.10 exactly, npm audit flags every project that installs it. The suggested npm audit fix --force downgrades the plugin to 0.5.4, so right now the only way around it is an overrides entry.

The one breaking change in 7.0 makes inserting nodes during iteration safe. commonTrailingPseudos loops over copied arrays, so it isn't affected. I kept the exact pin to match how the dependency was declared before.

Test plan

npm test passes. The trailing pseudo element tests cover the only code that uses the parser.
Built a Tailwind v4 app with the plugin on 6.0.10 and on 7.1.6. The generated CSS is identical.

vercel · 2026-10-06T07:59:43Z

@NickBevers is attempting to deploy a commit to the Tailwind Labs Team on Vercel.

A member of the Team first needs to authorize it.

## Summary - Resolve the development-tool [KaTeX advisory](GHSA-238p-pmpm-9mq7) and [smol-toml advisory](GHSA-r4xh-jqrq-34v2) with overrides scoped to their Markdown lint consumers. `micromark-extension-math` still requires `katex ^0.16.0`, and `markdownlint-cli2` pins `smol-toml 1.8.0`, so select the published fixes `0.19.0` and `1.9.0` respectively. - Refresh the npm lockfile and Nix dependency hash, and add the override package names to the spelling dictionary. The compiler and conventions changes from #1 are merged. ### Remaining upstream advisories The development graph still contains the [braces advisory](GHSA-vfj7-8cjw-p6xm), for which GitHub lists no patched release. The production graph still contains the [PostCSS selector parser advisory](GHSA-rj75-hqrm-r3gf) through `@tailwindcss/typography`. Its upstream dependency update is tracked in [tailwindlabs/tailwindcss-typography#429](tailwindlabs/tailwindcss-typography#429). ## Test plan - [x] Frozen `npm ci --ignore-scripts` succeeds, and all eight command tests pass. - [x] `npm run format`, `npm run lint`, and `npm run spellcheck` pass. - [x] KaTeX renders representative math and rejects inherited trust settings. The micromark math extension renders inline and display math. smol-toml parses 4,096 distinct keys correctly. - [x] `npm audit --json` confirms both fixed advisories are absent. `npm audit --omit=dev --json` confirms the remaining production findings are limited to typography and its selector parser dependency. - [x] `nix flake check` and `nix build .#kiln-tailwindcss` pass on aarch64-darwin. - [x] Normal hooks and `git diff --check` pass. - [ ] GitHub Actions on the rebased dependency revision.

jnbn · 2026-10-11T20:29:48Z

I tested this parser upgrade and prepared a plugin-level regression that can be included in this PR.

The fixture supplies a typography selector with 300 nested :not() functions. Parser 6.0.10 accepts it. Parser 7.1.6 rejects it with its standard nesting-depth error. The 16 existing tests pass with both versions. All 17 tests pass with 7.1.6.

test('rejects selectors beyond the parser nesting limit without a stack overflow', async () => {
  let selector = ':not('.repeat(300) + '.item' + ')'.repeat(300)
  let config = {
    content: [{ raw: html`<div class="prose"></div>` }],
    theme: {
      typography: {
        DEFAULT: {
          css: {
            [selector]: { color: 'red' },
          },
        },
      },
    },
  }

  await expect(run(config)).rejects.toThrow(
    'Cannot parse selector: nesting depth exceeds the maximum of 256.'
  )
})

Verification used npm test -- --runInBand on Node 26.8.2. The package runtime audit reports 0 vulnerabilities.

This test covers the nesting limit. It does not measure the flat-selector performance defect in GHSA-rj75-hqrm-r3gf. The dependency upgrade in this PR supplies that fix.

…ypography @tailwindcss/typography pins postcss-selector-parser 6.0.10, affected by GHSA-rj75-hqrm-r3gf and fixed in 7.1.6. A scoped npm override installs 7.1.6 for the plugin until tailwindlabs/tailwindcss-typography#429 ships. The built CSS is byte-identical, npm audit is clean, and the matching osv-scanner ignore is removed. Spec impact: Feature 096 plan backlog notes the override and its removal condition.

We ran the following as per usual, but not before some extra hackery (see below): python manage.py tailwind update python manage.py tailwind build prompted by: GHSA-rj75-hqrm-r3gf Extra hackery is needed because the usual update cannot install the fixed parser because @tailwindcss/typography 0.5.20 pins postcss-selector-parser to 6.0.10. The hack is just to override explicitly with 7.1.6. There's an upstream [PR on the typography package](tailwindlabs/tailwindcss-typography#429) Once it's eventually fixed, our solution can be backed out again. the key bit of infomration is that the only breaking change in 7.0 (safeness of insertion during iteration) does not apply because the typography package didn't do that anyway. The affected packages are only used for local builds, so the reported security issue does not affect Bugsink at runtime. The generated CSS is unchanged.

Run npm audit fix to clear the five high-severity vulnerabilities. Add an override scoped to @tailwindcss/typography that forces the patched postcss-selector-parser. Every typography release pins 6.0.10. Drop the override once typography ships postcss-selector-parser 7.1.6 or later (tailwindlabs/tailwindcss-typography#429). Closes #234

sakshamgoyal-01 · 2026-10-20T15:36:32Z

Hey is there an ETA for this? Our CI is complaining about this

## Summary Fixes the `browser-smoke` job, which fails on `main` and every PR at the **Audit npm dependencies** step. - `npm audit fix` (without `--force`) updates `package-lock.json` within the existing `package.json` ranges: - axios 1.18.1 → 1.20.0 - follow-redirects 1.16.0 → 1.16.1 - source-map-js 1.2.1 → 1.2.2 - vite 6.4.3 → 6.4.4 - Adds an npm `overrides` entry to force `postcss-selector-parser` to `^7.1.6` (resolves to 7.1.7). This fixes GHSA-rj75-hqrm-r3gf. The latest `@tailwindcss/typography` (0.5.20) pins the vulnerable 6.0.10 exactly, and `npm audit fix --force` would downgrade typography to 0.5.4, which is a breaking change. The upstream bump is tailwindlabs/tailwindcss-typography#429. Remove the override once typography ships a release with that bump. ## Effects - Frontend build tooling only. No PHP, migrations, cache keys, scheduled jobs or queue workers are affected. - The compiled `app.css` is byte-identical before and after the override, so `prose` styling does not change. - Post-deploy: rebuild front-end assets as usual (`npm ci && npm run build`). No other manual steps. ## Verification - `npm audit`: 0 vulnerabilities - `npm ci` from the committed lockfile succeeds - `npm run build` succeeds - `npm run test:browser`: 75/75 passed locally

stevebauman · 2026-10-21T16:41:49Z

  },
  "dependencies": {
-    "postcss-selector-parser": "6.0.10"
+    "postcss-selector-parser": "7.1.6"


Can we omit a hard pin entirely so this package automatically supports CVE patches?

Suggested change

"postcss-selector-parser": "7.1.6"

"postcss-selector-parser": "^7.1.6"

stevebauman · 2026-10-21T16:43:27Z

Ping @RobinMalfait

Update postcss-selector-parser to v7.1.6

3bb1eb3

NickBevers force-pushed the bump-postcss-selector-parser branch from aabf974 to 3bb1eb3 Compare October 6, 2026 07:59

ragnos-dev mentioned this pull request Oct 6, 2026

Repair remaining production dependency chains and verify compatibility ragnos-labs/paperclip#31

Merged

11 of 14 tasks

hakula139 mentioned this pull request Oct 6, 2026

fix(deps): patch vulnerable Markdown tooling dependencies hakula139/kiln-tailwindcss#2

Merged

7 tasks done

junginho0901 mentioned this pull request Oct 7, 2026

Answer 404 for an unknown cluster id; override postcss-selector-parser to 7.1.6 junginho0901/Kubeast#267

Merged

6 tasks done

FreekMencke mentioned this pull request Oct 7, 2026

chore(deps): replace @tailwindcss/typography with markdown styles osrs-tracker/osrs-tracker-web#69

Merged

ildyria mentioned this pull request Oct 8, 2026

Fix sprintf vulnerability LycheeOrg/Lychee#4856

Merged

afadil mentioned this pull request Oct 8, 2026

fix(deps): bump proxy-addr and source-map-js to patched releases wealthfolio/wealthfolio#1927

Merged

1 task

andycroll mentioned this pull request Oct 11, 2026

Update Tailwind typography and patch selector parser andycroll/andycroll.com#296

Merged

mia-riezebos mentioned this pull request Oct 14, 2026

fix(deps): patch Typography selector parsing mia-cx/ditherette#398

Merged

ajanraj mentioned this pull request Oct 16, 2026

@tailwindcss/typography pins a vulnerable postcss-selector-parser (GHSA-rj75-hqrm-r3gf) ajanraj/OpenChat#91

Open

vanschelven mentioned this pull request Oct 18, 2026

tailwind update bugsink/bugsink#556

Merged

zorn mentioned this pull request Oct 19, 2026

Clear the npm audit vulnerabilities in build tooling zorn/mikezornek.com#234

Closed

4 tasks

zorn mentioned this pull request Oct 19, 2026

build: clear the npm audit vulnerabilities in build tooling zorn/mikezornek.com#236

Merged

Yosodog mentioned this pull request Oct 21, 2026

Update npm packages to fix security advisories Yosodog/Nexus-AMS#430

Merged

stevebauman reviewed Oct 21, 2026

View reviewed changes

ikegawa-koshi mentioned this pull request Oct 22, 2026

依存パッケージの脆弱性を解消し、Hugoを0.168.0へ更新 sig-sc/sig-sc.github.io#116

Merged

grist-worker mentioned this pull request Oct 22, 2026

Upgrade dependencies and fix vulnerabilities KennethWussmann/boilerplate-fullstack-typescript#75

Merged

This was referenced Oct 23, 2026

chore(security): bump kit and vite, refresh vulnerable transitive deps kauredo/cv-page#20

Merged

chore(deps): drop unused @tailwindcss/typography kauredo/cv-page#21

Merged

Navigation Menu

Repository navigation

Update postcss-selector-parser to v7.1.6 - #429

Update postcss-selector-parser to v7.1.6#429
NickBevers wants to merge 1 commit into
tailwindlabs:mainfrom
NickBevers:bump-postcss-selector-parser

NickBevers commented Oct 6, 2026

Uh oh!

vercel Bot commented Oct 6, 2026

Uh oh!

jnbn commented Oct 11, 2026

Uh oh!

sakshamgoyal-01 commented Oct 20, 2026

Uh oh!

stevebauman Oct 21, 2026 •

edited

Loading

Uh oh!

stevebauman commented Oct 21, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	"postcss-selector-parser": "7.1.6"
	"postcss-selector-parser": "^7.1.6"

Conversation

NickBevers commented Oct 6, 2026

Test plan

Uh oh!

vercel Bot commented Oct 6, 2026

Uh oh!

jnbn commented Oct 11, 2026

Uh oh!

sakshamgoyal-01 commented Oct 20, 2026

Uh oh!

stevebauman Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stevebauman commented Oct 21, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

stevebauman Oct 21, 2026 •

edited

Loading