This is an automated email from the ASF dual-hosted git repository.
morningman pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris-website.git
The following commit(s) were added to refs/heads/master by this push:
new f2ec14ebc782 build(deps): patch postcss, follow-redirects, shell-quote
and lodash (#4478)
f2ec14ebc782 is described below
commit f2ec14ebc782052323f56515f6b51b86e9280075
Author: Mingyu Chen (Rayner) <[email protected]>
AuthorDate: Fri Oct 23 12:31:29 2026 +0100
build(deps): patch postcss, follow-redirects, shell-quote and lodash (#4478)
Supersedes #3572, #3552 and #3519.
- **postcss** 8.5.3 → 8.5.31. #3572 stopped at 8.5.10, which only fixes
GHSA-qx2v-qp2m-jg93; the high arbitrary file read (GHSA-6g55-p6wh-862q),
path traversal (GHSA-r28c-9q8g-f849) and the incomplete fix
(GHSA-fxqj-rqcc-2cmp) require 8.5.12 / 8.5.18 / 8.5.23. 8.5.31 is the
current 8.x release.
- **follow-redirects** 1.15.9 → 1.16.1. #3552 targeted 1.16.0, which
fixes GHSA-r4q5-vmmm-2653 but introduces two high advisories fixed only
in 1.16.1 (CVE-2026-111755, CVE-2026-111756).
- **shell-quote** 1.8.2 → 1.12.0 for the `react-dev-utils` path. #4418
updated launch-editor's copy to 1.12.0 but left the `react-dev-utils`
copy at 1.8.2; this consolidates both ranges on 1.12.0
(GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv).
- **lodash** 4.17.23 → 4.18.1. #3519 has an April-era head that no
longer works with the current Build Check workflow (the job checks out
the PR head and now expects `scripts/i18n/check-configuration.cjs`).
4.18.1 fixes GHSA-r5fr-rjxr-66jc (high, `_.template` code injection) and
GHSA-f23m-r3pf-42rh (medium, prototype pollution via
`_.unset`/`_.omit`).
- **nanoid** 3.3.8 → 3.3.20, required by postcss 8.5.31.
The change is lockfile-only; `package.json` is unchanged.
Validation:
- `yarn install --frozen-lockfile --ignore-scripts` passes on top of
current master.
- `yarn audit` reports no advisories for postcss, follow-redirects,
shell-quote, lodash or nanoid.
- Only `yarn.lock` is changed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: morningman <[email protected]>
Co-authored-by: Claude Code <[email protected]>
---
yarn.lock | 39 +++++++++++++++++----------------------
1 file changed, 17 insertions(+), 22 deletions(-)
diff --git a/yarn.lock b/yarn.lock
index 5d8d967fca72..c290a52a480d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -6533,9 +6533,9 @@ flat@^5.0.2:
integrity
sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==
follow-redirects@^1.0.0:
- version "1.15.9"
- resolved
"https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.9.tgz#a604fa10e443bf98ca94228d9eebcc2e8a2c8ee1";
- integrity
sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==
+ version "1.16.1"
+ resolved
"https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.16.1.tgz#6e0efa40a727fb369b98dab15883ec34787d675e";
+ integrity
sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==
for-each@^0.3.3:
version "0.3.5"
@@ -8128,9 +8128,9 @@ lodash.uniq@^4.5.0:
integrity
sha512-xfBaXQd9ryd9dlSDvnvI0lvxfLJlYAZzXomUYzLKtUeOQvOP5piqAWuGtrhWeqaXK9hhoM/iyJc5AV+XfsX3HQ==
lodash@^4.15.0, lodash@^4.17.20, lodash@^4.17.21:
- version "4.17.23"
- resolved
"https://registry.yarnpkg.com/lodash/-/lodash-4.17.23.tgz#f113b0378386103be4f6893388c73d0bde7f2c5a";
- integrity
sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==
+ version "4.18.1"
+ resolved
"https://registry.yarnpkg.com/lodash/-/lodash-4.18.1.tgz#ff2b66c1f6326d59513de2407bf881439812771c";
+ integrity
sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==
longest-streak@^3.0.0:
version "3.1.0"
@@ -9059,10 +9059,10 @@ mz@^2.7.0:
object-assign "^4.0.1"
thenify-all "^1.0.0"
-nanoid@^3.3.8:
- version "3.3.8"
- resolved
"https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.8.tgz#b1be3030bee36aaff18bacb375e5cce521684baf";
- integrity
sha512-WNLf5Sd8oZxOm+TzppcYk8gVOgP+l58xNy58D0nbUnOxOWRWvlcCV4kUF7ltmI6PsrLl/BgKEyS4mqsGChFN0w==
+nanoid@^3.3.20:
+ version "3.3.20"
+ resolved
"https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.20.tgz#dfd4444d85aa10111ef66ba85ed72e08ba0855d8";
+ integrity
sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==
[email protected]:
version "0.6.3"
@@ -10104,13 +10104,13 @@ postcss-zindex@^6.0.2:
integrity
sha512-5BxW9l1evPB/4ZIc+2GobEBoKC+h8gPGCMi+jxsYvd2x0mjq7wazk6DrP71pStqxE9Foxh5TVnonbWpFZzXaYg==
postcss@^8.4.21, postcss@^8.4.24, postcss@^8.4.26, postcss@^8.4.32,
postcss@^8.4.33, postcss@^8.4.38, postcss@^8.4.47:
- version "8.5.3"
- resolved
"https://registry.yarnpkg.com/postcss/-/postcss-8.5.3.tgz#1463b6f1c7fb16fe258736cba29a2de35237eafb";
- integrity
sha512-dle9A3yYxlBSrt8Fu+IpjGT8SY8hN0mlaA6GY8t0P5PjIOZemULz/E2Bnm/2dcUOena75OTNkHI76uZBNUUq3A==
+ version "8.5.31"
+ resolved
"https://registry.yarnpkg.com/postcss/-/postcss-8.5.31.tgz#d44731fa02f8ae8371629ec7220e2ae0dbdf23ec";
+ integrity
sha512-YUbWYCgErwnMAVkjUnYa+KlMBzGpHwiIt/DE7f0G33AuX2LH9UcTk6KgWxd3zRU+pN3u/C+Xl3EnMLM4Hea7Sg==
dependencies:
- nanoid "^3.3.8"
+ nanoid "^3.3.20"
picocolors "^1.1.1"
- source-map-js "^1.2.1"
+ source-map-js "^1.2.2"
pretty-bytes@^5.3.0:
version "5.6.0"
@@ -11566,16 +11566,11 @@ shebang-regex@^3.0.0:
resolved
"https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-3.0.0.tgz#ae16f1644d873ecad843b0307b143362d4c42172";
integrity
sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==
-shell-quote@^1.10.0:
+shell-quote@^1.10.0, shell-quote@^1.7.3:
version "1.12.0"
resolved
"https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.12.0.tgz#e98fdfd2e921d8a58ae2820f4fc0f75c39f09675";
integrity
sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==
-shell-quote@^1.7.3:
- version "1.8.2"
- resolved
"https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.2.tgz#d2d83e057959d53ec261311e9e9b8f51dcb2934a";
- integrity
sha512-AzqKpGKjrj7EM6rKVQEPpB288oCfnrEIuyoT9cyF4nmGa7V8Zk6f7RRqYisX8X9m+Q7bd632aZW4ky7EhbQztA==
-
shelljs@^0.8.5:
version "0.8.5"
resolved
"https://registry.yarnpkg.com/shelljs/-/shelljs-0.8.5.tgz#de055408d8361bed66c669d2f000538ced8ee20c";
@@ -11703,7 +11698,7 @@ [email protected]:
resolved
"https://registry.yarnpkg.com/sort-css-media-queries/-/sort-css-media-queries-2.2.0.tgz#aa33cf4a08e0225059448b6c40eddbf9f1c8334c";
integrity
sha512-0xtkGhWCC9MGt/EzgnvbbbKhqWjl1+/rncmhTh5qCpbYguXh6S/qwePfv/JQ8jePXXmqingylxoC49pCkSPIbA==
-"source-map-js@>=0.6.2 <2.0.0", source-map-js@^1.0.1, source-map-js@^1.2.1:
+"source-map-js@>=0.6.2 <2.0.0", source-map-js@^1.0.1, source-map-js@^1.2.1,
source-map-js@^1.2.2:
version "1.2.2"
resolved
"https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.2.tgz#79fb88d97535a21cb27162cb05d211b67acea4ab";
integrity
sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
