StoneCypher / jssm / 703bbd0bf7fbf9a9808ff1f88a12783a7310a1df

100%

master: 100%

Pull #974

github

build(deps-dev): bump postcss to 8.5.23 and release 5.163.6

postcss <= 8.5.17 is a high-severity advisory reached through vitest -> vite -> postcss. Dev-only and genuinely so: vitest never ships to consumers, unlike the fast-uri case in 5.163.5 where GitHub's 'development' label was wrong.

Adds the version bump dependabot cannot do (every push to main is a release, so a lockfile-only PR fails verify-version-bump) plus the full release build a publish requires.

brace-expansion is NOT fixed here and cannot be without a breaking change: the vulnerable 1.1.15 arrives via text_audit -> glob@7 -> minimatch@3, and npm can only clear it by installing glob@13, which would break text_audit. The other five brace-expansion copies in the tree are already on the patched 5.0.7. Left for a separate upstream fix to text_audit.

2652 of 2652 branches covered (100.0%)

Branch coverage included in aggregate %.

2 of 2 new or added lines in 1 file covered. (100.0%)

4288 of 4288 relevant lines covered (100.0%)

49075.38 hits per line