#929 Bump the npm_and_yarn group across 1 directory with 2 updates Pull request opened by dependabot[bot] Bumps the npm_and_yarn group with 2 updates in the /frontend directory: postcss and undici. Updates

postcss

from 8.5.16 to 8.5.25 Release notes Sourced from postcss's releases.

8.5.25

• Fixed 8.5.17 visitor regression.

• Fixed

list.split()

for non-string values (by `@​amir-rezaei`).

8.5.24

• Preserve the BOM after the processing (by `@​hdimer`).

8.5.23

• Do not load source map without

opts.from

for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by `@​sarathfrancis90`).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by `@​sarathfrancis90`).

• Fixed docs (by `@​isker`).

8.5.20

• Fixed missing space if

AtRule#params

is set after (by `@​sarathfrancis90`).

• Fixed mixing AST error on warnings (by `@​MahinAnowar`).

8.5.19

• Fixed cleaning

before

for new nodes inserted to

Root

(by `@​MahinAnowar`).

8.5.18

• Restricted loading previous source maps file to the

opts.from

folder for security reasons (use

unsafeMap: true

to disable the check).

8.5.17

• Fixed

Maximum call stack size exceeded

error.

• Fixed Prototype hijacking for

postcss.fromJSON()

.

• Fixed

Input#origin()

for unmapped end position (by `@​chatman-media`).

Changelog Sourced from postcss's changelog.

8.5.25

• Fixed 8.5.17 visitor regression.

• Fixed

list.split()

for non-string values (by `@​amir-rezaei`).

8.5.24

• Preserve the BOM after the processing (by `@​hdimer`).

8.5.23

• Do not load source map without

opts.from

for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by `@​sarathfrancis90`).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by `@​sarathfrancis90`).

• Fixed docs (by `@​isker`).

8.5.20

• Fixed missing space if

AtRule#params

is set after (by `@​sarathfrancis90`).

• Fixed mixing AST error on warnings (by `@​MahinAnowar`).

8.5.19

• Fixed cleaning

before

for new nodes inserted to

Root

(by `@​MahinAnowar`).

8.5.18

• Restricted loading previous source maps file to the

opts.from

folder for security reasons (use

unsafeMap: true

to disable the check).

8.5.17

• Fixed

Maximum call stack size exceeded

error.

• Fixed Prototype hijacking for

postcss.fromJSON()

.

• Fixed

Input#origin()

for unmapped end position (by `@​chatman-media`).

Commits • `08c989c` Release 8.5.25 version • `24f6814` Fix 8.5.17 visitor regression • `f2fa53f` Add supply chain security requirement to PostCSS plugin guide • `10edf0b` fix: return empty array for empty string in list.split (#2121) • `0ebe8ad` Release 8.5.24 version • `73218c6` Update dependencies • `9a114f6` Preserve the BOM when stringifying (#2119) • `9069261` Fix types check • `eb9e1fe` Release 8.5.23 version • `9d19c78` Update dependencies • Additional commits viewable in compare view Updates

undici

from 7.28.0 to 7.29.0 Release notes Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified

private

Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious

type

property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated

content-type

header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.

• GHSA-jr45-8vmc-qm54: optional whitespace around

=

in qualified

no-cache

and

private

directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.

• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale

Content-Length

after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose

Content-Length

is inconsistent with

Content-Range

. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.

• GHSA-v3r7-h72x-cjcm: unsanitized

domain

and

unparsed

values passed to

setCookie()

could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

Commits • <https://github.com/nodejs/undici/commit/9e38fc121d2eb26086d41c7d9379b47a6fada1c5|`9e… jmpsec/osctrl