chore(deps): bump postcss from 8.5.24 to 8.5.25 in /frontend - #36
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps): bump postcss from 8.5.24 to 8.5.25 in /frontend#36dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/frontend/postcss-8.5.22
branch
from
July 29, 2026 17:00
013a0c4 to
feb624c
Compare
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.24 to 8.5.25. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.24...8.5.25) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.22 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/frontend/postcss-8.5.22
branch
from
July 30, 2026 14:15
feb624c to
e92feb7
Compare
Iranman
added a commit
that referenced
this pull request
Jul 30, 2026
* fix: close non-app backend path flows and sanitize errors (SEC-002 wave 2) Independently traced and closed all 25 open CodeQL alerts in routes_submissions.py, routes_setup.py, routes_lidarr.py, and backend/transaction_engine.py (scope agreed with repo owner; app.py, index.html, and frontend files remain out of scope for a future wave). Genuine fixes: - routes_submissions.py _abs_resolved(): performed zero containment before Path.expanduser().resolve(); reachable from an authenticated GET query parameter (/api/submissions/target?path=...) with no other validation in the chain -- an arbitrary directory-read/audio-tag-parse primitive anywhere in the container filesystem. Fixed by requiring the resolved path fall under MUSIC_ROOT or DOWNLOADS_ROOT, reusing the existing _path_is_under()/_SUBMISSION_ALLOWED_ROOTS already present in the file (CodeQL #128). - routes_submissions.py: sanitized 3 genuinely broad `except Exception` handlers (submission_target, submission_reference_url's metadata fetch, validate_musicbrainz_release) that returned raw exception text; deliberate ValueError/KeyError paths with fixed safe messages are unchanged (CodeQL #323, #34, #36). - routes_setup.py: sanitized 6 broad-except response leaks (_write_env_file x2 call sites, AI/MusicBrainz/AcoustID/Plex connectivity tests) plus 2 unreported instances of the identical pattern found while reviewing the same functions (fpcalc check, dormant _check_path helper) (CodeQL #24, #25, #26, #27, #322). - routes_setup.py setup_test_ai(): "openai.com" in base_url matched any URL merely containing that substring; replaced with a real parsed- hostname check (CodeQL #102, py/incomplete-url-substring-sanitization). - routes_lidarr.py wanted_lidarr(): the true unbounded str(exc) source is app.py's _acq_fetch_lidarr_wanted() (out of scope this wave); fixed at this file's boundary instead, only echoing the known-safe "not configured" message (CodeQL #19). Proven false positives (14 total, dismissed on GitHub, each with an individual justification and a passing behavioral test -- see docs/TECHNICAL_DEBT.md SEC-002 for full per-alert detail): - #23, #28, #30, #31, #32, #33, #321: ValueError/KeyError raised only with fixed, deliberately-crafted, non-sensitive messages (env-var key names, numeric IDs the caller supplied, or OutboundPolicyError's own safe text), never a wrapped raw system exception. - #20, #21: routes_lidarr._http_error_message() already redacts every exception type except a RuntimeError carrying one of two fixed config-status strings from _lidarr_config_error(). - #129, #130, #131, #132, #133: TransactionStore._path() requires a txn_ prefix and rejects /, \, and NUL before any of its 5 flagged sink lines; it is the only path-construction site in the file. Also corrects docs/TECHNICAL_DEBT.md SEC-002's prior description of PR #52's #332/#334/#335 (previously described only as "fixed"; records that CodeQL's rescan still flagged them post-fix and they required a separate post-merge dismissal, with the reason each fix wasn't recognized by CodeQL's static model). * docs: update SEC-002 remediation history Corrects the PR #52 record (#332/#334/#335 required a post-merge dismissal, not just a code fix -- CodeQL's static model didn't recognize either mitigation) and records wave 2's full accounting: starting/in-scope counts, alert numbers, root-cause groups, fixes, dismissals, remaining 287-alert count (all in app.py/frontend), and the next recommended wave. * fix: check Lidarr config status directly instead of matching error text CodeQL flagged a new alert (#407) against the previous wanted_lidarr() fix: "not configured" in error.lower() distinguishes safe-to-echo messages from _acq_fetch_lidarr_wanted()'s own unbounded str(exc) by pattern-matching the exception TEXT, which isn't airtight -- a coincidentally-worded exception could slip through. Fixed by checking this file's own type-safe _lidarr_config_error() before ever calling _acq_fetch_lidarr_wanted(), removing the text-matching entirely.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps postcss from 8.5.24 to 8.5.25.
Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
08c989cRelease 8.5.25 version24f6814Fix 8.5.17 visitor regressionf2fa53fAdd supply chain security requirement to PostCSS plugin guide10edf0bfix: return empty array for empty string in list.split (#2121)