From b286f2d4f11b4d27ec2c4d1faeab6baf6200b99a Mon Sep 17 00:00:00 2001 From: "sasjs-dev[bot]" Date: Tue, 6 Oct 2026 09:34:46 +0000 Subject: [PATCH 1/2] fix(ci): name the postcss-selector-parser advisory in the toolchain audit The audit caught a new advisory, which is what it is for: GHSA-rj75-hqrm-r3gf, moderate, quadratic complexity in flat selector parsing. It cannot be fixed from here. The vulnerable copy is npm's own bundled dependency - release/node_modules/npm/node_modules/postcss-selector-parser - so no resolver change reaches it, and 11.21.0 is the last npm 11.x while @semantic-release/npm requires ^11. The eventual fix is that plugin moving to npm 12. It is also unreachable in this usage: the parser reads this repo's own release config, not the commits being matched. Named with that reasoning rather than silenced, so the audit still fails on anything new. 13 exempt, exit 0. --- release/audit.mjs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/release/audit.mjs b/release/audit.mjs index 061b412..0ea6d99 100644 --- a/release/audit.mjs +++ b/release/audit.mjs @@ -52,6 +52,10 @@ const EXEMPT = new Map([ 'GHSA-6j4f-fj2g-mc7p', 'brace-expansion, inside the npm package that @semantic-release/npm bundles.' ], + [ + 'GHSA-rj75-hqrm-r3gf', + 'postcss-selector-parser, inside the npm package that @semantic-release/npm bundles. Affected through 7.1.5. npm ships its own bundled copy, so no resolver change reaches it - 11.21.0 is the last 11.x and @semantic-release/npm requires ^11 - and the eventual fix is that plugin moving to npm 12. Unreachable here: the parser reads this repo\'s own release config, not the commits being matched.' + ], ['GHSA-rpw4-54j3-4h4q', 'ip-address, inside the npm package that @semantic-release/npm bundles.'], ['GHSA-2vr4-cq9g-pvrc', 'ip-address, inside the npm package that @semantic-release/npm bundles.'], ['GHSA-j6r3-76f7-8jcv', 'ip-address, inside the npm package that @semantic-release/npm bundles.'], From 25bf13c53638fe0015b338b18bd4758b88cc8ab3 Mon Sep 17 00:00:00 2001 From: "sasjs-dev[bot]" Date: Tue, 6 Oct 2026 09:40:48 +0000 Subject: [PATCH 2/2] fix(ci): name the postcss-selector-parser advisory in the toolchain audit The audit caught a new advisory, which is what it is for: GHSA-rj75-hqrm-r3gf, moderate, quadratic complexity in flat selector parsing. It cannot be fixed from here. The vulnerable copy is npm's own bundled dependency - release/node_modules/npm/node_modules/postcss-selector-parser - so no resolver change reaches it, and 11.21.0 is the last npm 11.x while @semantic-release/npm requires ^11. The eventual fix is that plugin moving to npm 12. It is also unreachable in this usage: the parser reads this repo's own release config, not the commits being matched. Named with that reasoning rather than silenced, so the audit still fails on anything new. 13 exempt, exit 0. --- release/audit.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/release/audit.mjs b/release/audit.mjs index 0ea6d99..b38a8b2 100644 --- a/release/audit.mjs +++ b/release/audit.mjs @@ -54,7 +54,7 @@ const EXEMPT = new Map([ ], [ 'GHSA-rj75-hqrm-r3gf', - 'postcss-selector-parser, inside the npm package that @semantic-release/npm bundles. Affected through 7.1.5. npm ships its own bundled copy, so no resolver change reaches it - 11.21.0 is the last 11.x and @semantic-release/npm requires ^11 - and the eventual fix is that plugin moving to npm 12. Unreachable here: the parser reads this repo\'s own release config, not the commits being matched.' + "postcss-selector-parser, inside the npm package that @semantic-release/npm bundles. Affected through 7.1.5. npm ships its own bundled copy, so no resolver change reaches it - 11.21.0 is the last 11.x and @semantic-release/npm requires ^11 - and the eventual fix is that plugin moving to npm 12. Unreachable here: the parser reads this repo's own release config, not the commits being matched." ], ['GHSA-rpw4-54j3-4h4q', 'ip-address, inside the npm package that @semantic-release/npm bundles.'], ['GHSA-2vr4-cq9g-pvrc', 'ip-address, inside the npm package that @semantic-release/npm bundles.'],