chore(deps): security bumps — postcss, shell-quote (AXE-3900/AXE-3901)

[chikara1608]

Pins two vulnerable transitive dev dependencies via package.json overrides, so the fixes survive lockfile regeneration instead of living only in the lock.

Ticket	Package	Before	After	First patched	Advisory
AXE-3901	shell-quote	1.8.4	1.10.0	1.9.0	GHSA-395f-4hp3-45gv — quadratic-complexity DoS in parse()
AXE-3900	postcss	8.5.6	removed from tree (8.5.25 floor kept as guard)	8.5.12	GHSA-6g55-p6wh-862q — arbitrary file read via attacker-controlled sourceMappingURL

No runtime exposure

axe-core declares no dependencies — everything is devDependencies, so neither package ships in the published bundle:

• shell-quote ← npm-run-all (build scripts)
• postcss ← @csstools/css-syntax-patches-for-csstree ← cssstyle ← jsdom (test-time DOM)

Both were marked dev: true in the lock before this change.

Why postcss disappears rather than moving to 8.5.25

Adding the postcss override made npm re-resolve that subtree, which refreshed @csstools/css-syntax-patches-for-csstree 1.0.14 → 1.1.7 — in-range for cssstyle's ^1.0.14. That version no longer depends on postcss at all, so postcss and its own dep nanoid drop out of the tree.

The postcss: 8.5.25 override is deliberately retained as a floor guard: the jsdom/cssstyle chain churns often, and if any future dependency reintroduces postcss it will be forced onto a patched version rather than silently reopening AXE-3900.

Full set of lockfile version changes

Audited exhaustively — nothing moved outside declared ranges, and everything here is dev-only:

shell-quote                              1.8.4   -> 1.10.0   (intended fix)
@csstools/css-syntax-patches-for-csstree 1.0.14  -> 1.1.7     (in-range, drops postcss)
css-tree                                 3.1.0   -> 3.2.1     (in-range for cssstyle ^3.1.0)
mdn-data                                 2.12.2  -> 2.27.1    (transitive of css-tree)
postcss                                  8.5.6   -> removed
nanoid                                   3.3.11  -> removed    (postcss's own dep)

lockfileVersion: 2 preserved via --lockfile-version=2 (npm 10 would otherwise rewrite it to v3).

Verification

• npm ci --dry-run clean — lock and package.json in sync.
• jsdom computed-style smoke test passes on the bumped css-tree 3.2.1 (color, display: flex, margin-top all resolve correctly), confirming the CSS stack that feeds the unit-test DOM still works.
• Confirmed require.resolve('postcss') now fails in the installed tree, i.e. it is genuinely gone rather than hoisted elsewhere.

Supersedes

These Dependabot PRs are lock-only and are made redundant by this one — they can be closed once this merges:

• chore: bump shell-quote from 1.8.4 to 1.10.0 #271 — bump shell-quote 1.8.4 → 1.10.0
• chore: bump postcss from 8.5.6 to 8.5.22 #269 — bump postcss 8.5.6 → 8.5.22 (below the 8.5.25 floor here, and postcss is now removed outright)

Related

The sibling remediation for the other six advisories (AXE-3885, AXE-3895–AXE-3899) is in a11y-engine — sharp, axios, js-yaml, brace-expansion, fast-uri.

🤖 Generated with Claude Code