8000 fix: update svgo, colord, postcss-svgo to resolve Dependabot alerts by dominicusin · Pull Request #426 · dominicusin/dominicusin.github.io · GitHub
[go: up one dir, main page]
Skip to content

fix: update svgo, colord, postcss-svgo to resolve Dependabot alerts - #426

Merged
dominicusin merged 1 commit into
mainfrom
fix/dependabot-security
Sep 9, 2026
Merged

fix: update svgo, colord, postcss-svgo to resolve Dependabot alerts#426
dominicusin merged 1 commit into
mainfrom
fix/dependabot-security

Conversation

@dominicusin
@dominicusin dominicusin commented Sep 9, 2026 •
edited by coderabbitai Bot
Loading
Copy link
Copy Markdown
Owner

Summary

  • Update svgo 4.0.2 → 4.1.0 (fixes removeScripts XSS bypass — high severity)
  • Update colord 2.9.3 → 2.10.0 (fixes slow rejection DoS — medium severity)
  • Update postcss-svgo 8.0.4 → 9.0.2

Why

Dependabot reported 3 open vulnerabilities (1 high, 2 medium) related to SVG processing and color string parsing.

Validation

  • hugo --gc --minify builds successfully (527 pages, 150 aliases, 0 errors)
  • npm run test — ALL TESTS PASSED

Summary by CodeRabbit

  • Chores
    • Updated underlying libraries to newer versions.
    • No user-facing features or behavior changed in this release.

@dominicusin
fix: update svgo, colord, postcss-svgo to resolve Dependabot alerts
d2581bd 
- svgo: 4.0.2 → 4.1.0 (fixes removeScripts XSS bypass)
- colord: 2.9.3 → 2.10.0 (fixes slow rejection DoS)
- postcss-svgo: 8.0.4 → 9.0.2
@bolt-new-by-stackblitz
bolt-new-by-stackblitz Bot commented Sep 9, 2026
Copy link
Copy Markdown

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

Copilot AI commented Sep 9, 2026
Copy link
Copy Markdown

@dominicusin Thanks for sending me some feedback. Unfortunately, I hit an error while trying to use the custom Copilot setup steps configured for this repository. The error I am seeing is:

no supported setup-steps job found in your workflow file. Please ensure you have a job named copilot-setup-steps. For more details, see https://gh.io/copilot/actions-setup-steps

Once you or someone with the necessary access fixes the problem, please let me know in a comment and I'll try again. Thanks!

@vercel
vercel Bot commented Sep 9, 2026
8000 Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
dominicusin-github-io Error Error Sep 9, 2026 10:46am UTC
3 Skipped Deployments
Project Deployment Actions Updated
dominicusin-dominicusin.github.io Ignored Ignored Sep 9, 2026 10:46am UTC
dominicusin-dominicusin.github.io-lw64 Ignored Ignored Sep 9, 2026 10:46am UTC
dominicusin-github-io-5612 Ignored Ignored v0 Sep 9, 2026 10:46am UTC

@github-actions github-actions Bot added the dependencies Pull requests that update a dependency file label Sep 9, 2026
@github-actions
github-actions Bot commented Sep 9, 2026
Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/colord 2.10.0 🟢 5
Details
CheckScoreReason
Code-Review⚠️ 1Found 5/27 approved changesets -- score normalized to 1
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1017 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/css-select 6.0.0 🟢 6.4
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ -1Found no human activity in the last 30 changesets
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Packaging🟢 10packaging workflow detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
npm/css-what 7.0.0 🟢 6.5
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ -1Found no human activity in the last 30 changesets
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Packaging🟢 10packaging workflow detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
npm/postcss-svgo 8.0.6 🟢 7.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Code-Review⚠️ 0Found 1/15 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
npm/postcss-svgo 9.0.2 🟢 7.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Code-Review⚠️ 0Found 1/15 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
npm/svgo 4.1.0 🟢 6.7
Details
CheckScoreReason
Code-Review⚠️ 1Found 4/29 approved changesets -- score normalized to 1
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits

Scanned Files

  • package-lock.json

@coderabbitai
coderabbitai Bot commented Sep 9, 2026 •
edited
Loading
Copy link
< 8000 /span> Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 29482f67-19a3-4a82-9c6c-2bad4195d084

📥 Commits

Reviewing files that changed from the base of the PR and between d0e1745 and d2581bd.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (1)
  • package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

This change updates the colord, postcss-svgo, and svgo dependency versions in package.json.

Changes

Dependency updates

Layer / File(s) Summary
Update package versions
package.json		 Updates the declared versions of colord, postcss-svgo, and svgo.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to d2581

This updates SVG optimization and color parsing dependencies to their intended patched versions with reproducible locked resolutions. No merge-blocking risk remains.

Suggested reviewers: qwen-intl

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the three updated dependencies and states that the updates address Dependabot alerts. It accurately summarizes the pull request changes.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/dependabot-security

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the package row
Three little versions start to grow
Colord hops ahead
SVGs are fed
The lockstep burrow starts to glow

Comment @coderabbitai help to get the list of available commands.

@qodo-code-review
qodo-code-review Bot commented Sep 9, 2026
Copy link
Copy Markdown

PR Summary by Qodo

Resolve SVG and color-processing dependency vulnerabilities

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

Grey Divider

AI Description 

• Upgrade SVG tooling to close the reported XSS bypass.
• Upgrade colord to prevent denial-of-service from pathological color inputs.
• Regenerate the lockfile with updated transitive dependencies and compatibility metadata.
Diagram 

graph TD
  Manifest["package.json"] --> Lockfile["package-lock.json"] --> Colord["colord 2.10.0"]
  Lockfile --> PostCSS["postcss-svgo 9.0.2"] --> SVGO["svgo 4.1.0"]
  Manifest --> PostCSS
  Manifest --> SVGO
Loading
High-Level Assessment

Directly upgrading the affected dependencies and regenerating the lockfile is the appropriate approach. Package overrides could force patched transitive versions with a smaller manifest change, but would obscure compatibility constraints and are unnecessary because supported direct releases are available.

Files changed (2) +47 / -29

Other (2) +47 / -29
package-lock.jsonResolve patched dependency and transitive package versions +44/-26

Resolve patched dependency and transitive package versions

• Pins colord 2.10.0, postcss-svgo 9.0.2, and svgo 4.1.0 with updated integrity metadata. It also records newer SVG selector dependencies, a nested postcss-svgo resolution, and revised Node/PostCSS compatibility requirements.

package-lock.json

package.jsonUpgrade vulnerable SVG and color-processing dependencies +3/-3

Upgrade vulnerable SVG and color-processing dependencies

• Raises colord to 2.10.0, postcss-svgo to 9.0.2, and svgo to 4.1.0 to address Dependabot security alerts.

package.json

@qodo-code-review
qodo-code-review Bot commented Sep 9, 2026
Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Grey Divider


Remediation recommended

1. CSS tooling has an invalid dependency tree 🐞 Bug ☼ Reliability
Description 
postcss-svgo@9.0.2 declares postcss ^8.5.28 as its peer, while the lockfile retains
postcss@8.5.26. Installs only succeed because .npmrc disables peer enforcement, so environments
that enforce peer contracts can reject the tree and the CSS optimizer runs against an unsupported
version.
Code

package.json[400]

+    "postcss-svgo": "^9.0.2",
Relevance

●●● Strong

Concrete peer mismatch from the requested dependency upgrade; updating PostCSS resolves the invalid
lockfile contract.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence 
The upgraded plugin's lockfile entry requires PostCSS ^8.5.28, but the root declaration begins at
8.5.26 and the resolved package remains exactly 8.5.26. The repository-wide legacy peer setting
explains why existing npm install and npm ci validation does not report the unsatisfied peer.

package.json[373-400]
package-lock.json[19711-19714]
package-lock.json[20132-20145]
.npmrc[1-1]

Agent prompt 
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`postcss-svgo@9.0.2` requires `postcss ^8.5.28`, but the repository still locks PostCSS 8.5.26. Update PostCSS and regenerate the lockfile so the dependency tree satisfies the plugin's peer contract without relying on legacy peer handling.

## Issue Context
The root PostCSS range begins at 8.5.26, and the current lockfile resolves that exact version. `.npmrc` currently masks the mismatch with `legacy-peer-deps=true`.

## Fix Focus Areas
- package.json[373-373]
- package-lock.json[19711-19714]
- package-lock.json[20142-20145]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Grey Divider

Context sources
✅ Compliance rules (platform): 10 rules
✅ Cross-repo context — repo relationships
Review mode: ⚖️ Balanced: This is a security-motivated dependency update affecting SVG/CSS processing, with transitive dependency and engine/peer changes that warrant a careful single-pass review.

Grey Divider

Tip of the day 
💡 Did you know, you can commit Qodo's fix in one click with committable suggestions (GitHub & GitLab)

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

qodo-code-review[bot]
qodo-code-review Bot reviewed Sep 9, 2026
View reviewed changes
Comment thread package.json
"postcss-reduce-transforms": "^8.0.3",
"postcss-selector-parser": "^7.1.5",
"postcss-svgo": "^8.0.4",
"postcss-svgo": "^9.0.2",
@qodo-code-review qodo-code-review Bot Sep 9, 2026
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Css tooling has an invalid dependency tree 🐞 Bug ☼ Reliability

postcss-svgo@9.0.2 declares postcss ^8.5.28 as its peer, while the lockfile retains
postcss@8.5.26. Installs only succeed because .npmrc disables peer enforcement, so environments
that enforce peer contracts can reject the tree and the CSS optimizer runs against an unsupported
version.
Agent Prompt 
## Issue description
`postcss-svgo@9.0.2` requires `postcss ^8.5.28`, but the repository still locks PostCSS 8.5.26. Update PostCSS and regenerate the lockfile so the dependency tree satisfies the plugin's peer contract without relying on legacy peer handling.

## Issue Context
The root PostCSS range begins at 8.5.26, and the current lockfile resolves that exact version. `.npmrc` currently masks the mismatch with `legacy-peer-deps=true`.

## Fix Focus Areas
- package.json[373-373]
- package-lock.json[19711-19714]
- package-lock.json[20142-20145]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

@dominicusin
dominicusin merged commit 40da3fc into main Sep 9, 2026
24 of 27 checks passed
@dominicusin
dominicusin deleted the fix/dependabot-security branch September 9, 2026 10:54

This branch had an error being deployed

1 failed deployment
Preview – dominicusin-github-io — d2581bda Deployed Sep 9, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@qodo-code-review qodo-code-review[bot] qodo-code-review[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file size/XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dominicusin
0