') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix: upgrade postcss to >=8.5.12 to address CVE-2026-45623 by TooTallNate · Pull Request #3067 · vercel/workflow · GitHub
Skip to content

fix: upgrade postcss to >=8.5.12 to address CVE-2026-45623 - #3067

Merged
TooTallNate merged 2 commits into
mainfrom
naterajlich/vuln-13433-dependency-vulnerability-cve-2026-45623-affects-postcss856
Jul 23, 2026
Merged

fix: upgrade postcss to >=8.5.12 to address CVE-2026-45623#3067
TooTallNate merged 2 commits into
mainfrom
naterajlich/vuln-13433-dependency-vulnerability-cve-2026-45623-affects-postcss856

Conversation

@TooTallNate

@TooTallNateTooTallNate commented Jul 23, 2026

Copy link
Copy Markdown
Member

Fixes VULN-13433

Summary

Socket.dev flagged postcss@8.5.6 (CVE-2026-45623, CVSS 7.5 High) — arbitrary file read / information disclosure via attacker-controlled sourceMappingURL comments in CSS input. Affected versions are < 8.5.12.

Changes

  • workbench/swc-playground/package.json: bump postcss from ^8.5 to ^8.5.12 (the manifest the alert was filed against)
  • docs/package.json: bump postcss from ^8.5.6 to ^8.5.12 — this workspace resolved the same vulnerable 8.5.6 in the lockfile
  • pnpm-lock.yaml: postcss@8.5.6 is fully removed; both workspaces (and the transitive @tailwindcss/postcss / vite consumers) now resolve postcss@8.5.16

Notes

  • No changeset needed: only private, unpublished workspaces (docs, workbench/swc-playground) are affected (pnpm changeset status --since=main passes)
  • A transitive postcss@8.4.31 remains in the lockfile (pinned by Next.js internally); it is not addressable via these manifests and is outside the scope of this alert, which targets the direct dependency

@TooTallNate
TooTallNate requested a review from ijjk as a code ownerJuly 23, 2026 19:37
CopilotAI review requested due to automatic review settings July 23, 2026 19:37
@TooTallNate
TooTallNate requested review from a team as code ownersJuly 23, 2026 19:37
@vercel

vercelBot commented Jul 23, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
example-nextjs-workflow-turbopackReadyReadyPreview, CommentJul 23, 2026 7:47pm
example-nextjs-workflow-webpackReadyReadyPreview, CommentJul 23, 2026 7:47pm
example-workflowReadyReadyPreview, CommentJul 23, 2026 7:47pm
workbench-astro-workflowReadyReadyPreview, CommentJul 23, 2026 7:47pm
workbench-express-workflowReadyReadyPreview, CommentJul 23, 2026 7:47pm
workbench-fastify-workflowReadyReadyPreview, CommentJul 23, 2026 7:47pm
workbench-hono-workflowReadyReadyPreview, CommentJul 23, 2026 7:47pm
workbench-nestjs-workflowBuildingBuildingPreview, CommentJul 23, 2026 7:47pm
workbench-nitro-workflowReadyReadyPreview, CommentJul 23, 2026 7:47pm
workbench-nuxt-workflowReadyReadyPreview, CommentJul 23, 2026 7:47pm
workbench-sveltekit-workflowReadyReadyPreview, CommentJul 23, 2026 7:47pm
workbench-tanstack-start-workflowReadyReadyPreview, CommentJul 23, 2026 7:47pm
workbench-vite-workflowReadyReadyPreview, CommentJul 23, 2026 7:47pm
workflow-docsReadyReadyPreview, Comment, Open in v0Jul 23, 2026 7:47pm
workflow-swc-playgroundReadyReadyPreview, CommentJul 23, 2026 7:47pm
workflow-tarballsReadyReadyPreview, CommentJul 23, 2026 7:47pm
workflow-webReadyReadyPreview, CommentJul 23, 2026 7:47pm

@changeset-bot

changeset-botBot commented Jul 23, 2026•
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 1131de3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions

github-actionsBot commented Jul 23, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

🧪 E2E Test Results

❌ Some tests failed

Summary

PassedFailedSkippedTotal
❌ ▲ Vercel Production144872391694
✅ 💻 Local Development133202081540
❌ 📦 Local Production162012271848
✅ 🐘 Local Postgres162102271848
✅ 🪟 Windows15400154
❌ 📋 Other101912121232
✅ vercel-multi-region270027
Total7221911138343

❌ Failed Tests

▲ Vercel Production (7 failed)

astro (1 failed):

  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_41KY88SXFM0GGB9G00WQBCNHZN | 🔍 observability

example (2 failed):

  • stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars) | wrun_41KY88Q1ZR0GW68G6PA6EVQ7EA | 🔍 observability
  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_41KY88SXFM0GGB9G00WQBCNHZN | 🔍 observability

fastify (1 failed):

  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_41KY88SXFM0GGB9G00WQBCNHZN | 🔍 observability

hono (1 failed):

  • error handling retry behavior regular Error retries until success

nextjs-turbopack (1 failed):

  • error handling retry behavior regular Error retries until success

vite (1 failed):

  • instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_41KY88SXFM0GGB9G00WQBCNHZN | 🔍 observability
📦 Local Production (1 failed)

nextjs-turbopack-canary (1 failed):

  • stepWinsRaceWorkflow | wrun_41KY88BSEM0GKB0PHHRYHR1X9E
📋 Other (1 failed)

e2e-vercel-prod-nest (1 failed):

  • error handling retry behavior regular Error retries until success

Details by Category

❌ ▲ Vercel Production
AppPassedFailedSkipped
❌ astro125128
❌ example124228
✅ express126028
❌ fastify125128
❌ hono125128
❌ nextjs-turbopack15013
✅ nextjs-webpack15103
✅ nitro126028
✅ nuxt126028
✅ sveltekit14509
❌ vite125128
✅ 💻 Local Development
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
❌ 📦 Local Production
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
❌ nextjs-turbopack-canary134119
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🐘 Local Postgres
AppPassedFailedSkipped
✅ astro-stable128026
✅ express-stable128026
✅ fastify-stable128026
✅ hono-stable128026
✅ nextjs-turbopack-canary135019
✅ nextjs-turbopack-stable15400
✅ nextjs-webpack-canary135019
✅ nextjs-webpack-stable15400
✅ nitro-stable128026
✅ nuxt-stable128026
✅ sveltekit-stable14707
✅ vite-stable128026
✅ 🪟 Windows
AppPassedFailedSkipped
✅ nextjs-turbopack15400
❌ 📋 Other
AppPassedFailedSkipped
✅ e2e-local-dev-nest-stable128026
✅ e2e-local-dev-tanstack-start-128026
✅ e2e-local-postgres-nest-stable128026
✅ e2e-local-postgres-tanstack-start-128026
✅ e2e-local-prod-nest-stable128026
✅ e2e-local-prod-tanstack-start-128026
❌ e2e-vercel-prod-nest125128
✅ e2e-vercel-prod-tanstack-start126028
✅ vercel-multi-region
AppPassedFailedSkipped
✅ nextjs-turbopack2700

📋 View full workflow run

❌ Some E2E test jobs failed:

  • Vercel Prod: failure
  • Local Dev: failure
  • Local Prod: failure
  • Local Postgres: success
  • Windows: success

Check the workflow run for details.

@github-actions

github-actionsBot commented Jul 23, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

📊 Workflow Benchmarks

commit 1131de3 · Thu, 23 Jul 2026 19:59:25 GMT · run logs

Backend: vercel · app: nextjs-turbopack

MetricScenarioBest (ms)P75 (ms)P90 (ms)P99 (ms)Samples
TTFSstep1135 (+363%) 🔻1274 🔴 (+14%)1299 🔴 (+13%)1328 🔴 (-13%)30
TTFSstream1212 (+525%) 🔻1263 🔴 (+17%) 🔻1278 🔴 (+15%)1309 🔴 (+2.4%)30
TTFShook + stream462 (+28%) 🔻1510 🔴 (+15%) 🔻1547 🔴 (+5.9%)1604 🔴 (-12%)30
STSO1020 steps (1-20)162 (-10%)269 🔴 (-33%) 💚303 🔴 (-38%) 💚501 🔴 (-12%)19
STSO1020 steps (101-120)185 (-7.5%)255 🔴 (-3.4%)293 🔴 (-26%) 💚423 🔴 (-35%) 💚19
STSO1020 steps (1001-1020)455 (-9.4%)521 🔴 (-10%)670 🔴 (+6.3%)3481 🔴 (+440%) 🔻19
WO1020 steps368381 (-14%)368381 (-14%)368381 (-14%)368381 (-14%)1
SLstream latency82 (-6.8%)126 🔴 (-13%)137 🔴 (-22%) 💚152 🔴 (-35%) 💚30

Best/P75/P90/P99 deltas compare against the most recent benchmark run on main at the time of this run. 🔻 flags a delta worse than +15%, 💚 one better than −15%.

Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt)

Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt)

🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120

All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor (clientStart) right before start(), so the CI runner’s request and its path through api.vercel.com sit outside every measured window. TTFS = in-deployment start() → first step body (turbo uses the in-process fast path, non-turbo the dispatch path), and includes the VQS dispatch hop plus any /flow cold start. STSO/WO are measured between step bodies on the deployment. SL is measured inside the workflow (parallel reader/writer steps), so it no longer includes the api.vercel.com read path.

Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the /flow invocation for a large fraction of runs, inflating P75+; the Best column shows the fastest (warm-start) sample for comparison.

CopilotAI reviewed Jul 23, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates postcss in private workspaces to remediate CVE-2026-45623 by ensuring direct workspace dependencies no longer allow resolving vulnerable <8.5.12 versions, and refreshes the lockfile to remove postcss@8.5.6.

Changes:

  • Bump postcss to ^8.5.12 in workbench/swc-playground and docs.
  • Update pnpm-lock.yaml so direct resolutions move to postcss@8.5.16 and postcss@8.5.6 is removed.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

FileDescription
workbench/swc-playground/package.jsonBumps the workspace devDependency postcss floor to a patched version.
docs/package.jsonBumps the workspace devDependency postcss floor to a patched version.
pnpm-lock.yamlRemoves postcss@8.5.6 and updates resolved postcss versions to 8.5.16.
Files not reviewed (1)
  • pnpm-lock.yaml: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment threadpnpm-lock.yaml Outdated
@TooTallNate
TooTallNate merged commit 9216556 into mainJul 23, 2026
92 of 102 checks passed
@TooTallNate
TooTallNate deleted the naterajlich/vuln-13433-dependency-vulnerability-cve-2026-45623-affects-postcss856 branch July 23, 2026 19:47
@github-actions

github-actionsBot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Backport to stable failed for 9216556 due to a workflow error (backport job run).

This is usually an infrastructure problem (e.g. the configured AI model could not be found, an AI Gateway error, or an opencode crash) rather than a merge conflict. Check the job logs linked above for details.

Once the underlying issue is fixed, re-run the Backport to stable workflow manually via workflow_dispatch and paste this commit SHA into the ref input:

9216556bf5505d798b7bef84ebd86739258fe497

This was referenced Jul 23, 2026
Merged
Merged
@github-actionsgithub-actionsBot mentioned this pull request Jul 24, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@VaguelySeriousVaguelySeriousVaguelySerious approved these changes
@karthikscale3karthikscale3karthikscale3 approved these changes
@ijjkijjkAwaiting requested review from ijjk

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@TooTallNate@VaguelySerious@karthikscale3