Jiseoup/showmycodePublic
EN|KO
  • Code
  • Commits
  • Pull Requests
← Back to list
Merged

fix: override vulnerable transitive deps (postcss, @babel/core)

#52
JiseoupJiseoup · Jul 4, 2026fix/override-vulnerable-transitive-deps → main
fix
OverviewCommitsFiles changed

What & Why

Add overrides to package.json to patch vulnerable transitive dependencies that Dependabot cannot auto-fix:

  • postcss: 8.4.31 → ^8.5.15 (fixes CVE-2026-41305, XSS via unescaped </style>)
  • @babel/core: 7.29.0 → ^7.29.7 (fixes CVE-2026-49356, arbitrary file read via sourceMappingURL)

Both are pinned by upstream packages (next, eslint-config-next), so overrides is the only way to force patched versions without waiting for upstream releases.

Related Issue

Resolves Dependabot security alerts for PostCSS and @babel/core.

How to Verify

  1. Run npm install && npm run lint && npm run build — all pass
  2. Check node_modules/postcss/package.json version ≥ 8.5.15
  3. Check node_modules/@babel/core/package.json version ≥ 7.29.7

Checklist

  • PR title follows Conventional Commits (feat:, fix:, chore:, refactor:, docs:, i18n:)
  • Translations added to both locales/ko.json and locales/en.json (if UI text changed)
  • Tested on mobile viewport (if UI changed)