🚨 [security] Update stylelint 14.16.1 → 17.15.0 (major) by depfu[bot] · Pull Request #264 · https-quantumblockchainai-atlassian-net/mkdocs-material

depfu · 2026-09-11T14:11:21Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ stylelint (14.16.1 → 17.15.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ postcss (8.4.21 → 8.5.28) · Repo · Changelog

Security Advisories 🚨

🚨 PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

🚨 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

🚨 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

🚨 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

🚨 PostCSS line return parsing error

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ braces (indirect, 3.0.2 → 3.0.3) · Repo · Changelog

Security Advisories 🚨

🚨 Uncontrolled resource consumption in braces

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ colord (indirect, 2.9.3 → 2.10.0) · Repo · Changelog

Security Advisories 🚨

🚨 Colord: Slow rejection of oversized malformed color strings

Release Notes

2.10.0 (from changelog)

2.9.7 (from changelog)

2.9.6 (from changelog)

2.9.5 (from changelog)

2.9.4 (from changelog)

Does any of this look wrong? Please let us know.

↗️ debug (indirect, 4.3.4 → 4.4.3) · Repo · Changelog

Security Advisories 🚨

🚨 debug@4.4.2 contains malware after npm account takeover

Release Notes

4.4.3

4.4.1

4.4.0

4.3.7

4.3.6

4.3.5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ fast-glob (indirect, 3.2.12 → 3.3.3) · Repo

Release Notes

3.3.3

3.3.2

3.3.1

3.3.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ fill-range (indirect, 7.0.1 → 7.1.1) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

Security Advisories 🚨

🚨 Prototype Pollution via parse() in NodeJS flatted

🚨 flatted vulnerable to unbounded recursion DoS in parse() revive phase

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ html-tags (indirect, 3.2.0 → 5.1.0) · Repo

Release Notes

5.1.0

5.0.0

4.0.0

3.3.1

3.3.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ meow (indirect, 9.0.0 → 14.1.0) · Repo

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ micromatch (indirect, 4.0.5 → 4.0.8) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in micromatch

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ms (indirect, 2.1.2 → 2.1.3) · Repo

Release Notes

2.1.3

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nanoid (indirect, 3.3.4 → 3.3.19) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ picocolors (indirect, 1.0.0 → 1.1.1) · Repo · Changelog

Release Notes

1.1.1

1.1.0

1.0.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ source-map-js (indirect, 1.0.2 → 1.2.1) · Repo · Changelog

Release Notes

1.2.1

1.2.0

1.1.0

1.0.3

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ supports-hyperlinks (indirect, 2.3.0 → 4.5.0) · Repo

Release Notes

4.5.0

3.1.0

3.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ table (indirect, 6.8.1 → 6.9.0) · Repo

Release Notes

6.9.0

6.8.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 @cacheable/memory (added, 2.2.0)

🆕 @cacheable/utils (added, 2.5.0)

🆕 @csstools/css-calc (added, 3.3.0)

🆕 @csstools/css-parser-algorithms (added, 4.0.0)

🆕 @csstools/css-syntax-patches-for-csstree (added, 1.1.13)

🆕 @csstools/css-tokenizer (added, 4.0.0)

🆕 @csstools/media-query-list-parser (added, 5.0.0)

🆕 @csstools/selector-resolve-nested (added, 4.0.1)

🆕 @keyv/bigmap (added, 1.3.1)

🆕 @keyv/serialize (added, 1.1.1)

🆕 @sindresorhus/merge-streams (added, 4.0.0)

🆕 cacheable (added, 2.5.0)

🆕 fast-uri (added, 3.1.7)

🆕 get-east-asian-width (added, 1.6.0)

🆕 hashery (added, 1.5.1)

🆕 hookified (added, 1.15.1)

🆕 import-meta-resolve (added, 4.2.0)

🆕 qified (added, 0.10.1)

🆕 unicorn-magic (added, 0.4.0)

🗑️ @types/minimist (removed)

🗑️ @types/normalize-package-data (removed)

🗑️ @types/parse-json (removed)

🗑️ camelcase-keys (removed)

🗑️ hard-rejection (removed)

🗑️ known-css-properties (removed)

🗑️ map-obj (removed)

🗑️ min-indent (removed)

🗑️ minimist-options (removed)

🗑️ quick-lru (removed)

🗑️ read-pkg-up (removed)

🗑️ redent (removed)

🗑️ strip-indent (removed)

🗑️ trim-newlines (removed)

🗑️ v8-compile-cache (removed)

🗑️ yargs-parser (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

bolt-new-by-stackblitz · 2026-09-11T14:11:25Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2026-09-11T14:11:26Z

⚠️ No Changeset found

Latest commit: 4ecd4a8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

guardrails · 2026-09-11T14:11:59Z

⚠️ We detected 32 security issues in this pull request:

Insecure Access Control (1)

Severity

Details

Docs

High

Title: Missing User Instruction

mkdocs-material/Dockerfile

Line 21 in 4ecd4a8

FROM python:3.11.0-alpine3.17

📚

More info on how to fix Insecure Access Control in Dockerfile.

Insecure Use of Crypto (2)

Severity

Details

Docs

Low

Title: Insecure hash functions

mkdocs-material/material/plugins/social/plugin.py

Line 155 in 4ecd4a8

]).encode("utf-8"))

📚

Low

Title: Insecure hash functions

mkdocs-material/src/plugins/social/plugin.py

Line 155 in 4ecd4a8

]).encode("utf-8"))

📚

More info on how to fix Insecure Use of Crypto in Python.

Vulnerable Libraries (29)

Severity	Details
High	underscore.js@1.8.3 upgrade to: >1.13.8
High	pkg:pypi/jinja2@3.0 upgrade to: 3.1.6
High	pkg:pypi/markdown@3.2 upgrade to: 3.8.1
High	pkg:pypi/mkdocs@1.4.2 - no patch available
Low	pkg:pypi/pygments@2.14 upgrade to: 2.20.0
High	pkg:pypi/pymdown-extensions@9.9.1 upgrade to: 11.0.1
Medium	pkg:pypi/requests@2.26 upgrade to: 2.32.4
High	pkg:npm/gitlab@14.2.2 upgrade to: > 14.2.2
Critical	pkg:npm/npm-check-updates@16.6.2 upgrade to: > 16.6.2
High	pkg:npm/autoprefixer@10.4.13 upgrade to: > 10.4.13
High	pkg:npm/stylelint@17.15.0 upgrade to: > 17.15.0
High	pkg:npm/cssnano@5.1.0 upgrade to: > 5.1.0
Medium	pkg:npm/esbuild@0.17.0 upgrade to: 0.25.0
Medium	pkg:npm/eslint-plugin-jsdoc@39.6.4 upgrade to: > 39.6.4
High	pkg:npm/stylelint-scss@4.3.0 upgrade to: > 4.3.0
High	pkg:npm/eslint@8.32.0 upgrade to: > 8.32.0
High	pkg:npm/eslint-plugin-import@2.27.4 upgrade to: > 2.27.4
Critical	pkg:npm/sass@1.57.1 upgrade to: > 1.57.1
High	pkg:npm/stylelint-config-standard-scss@6.1.0 upgrade to: > 6.1.0
Critical	pkg:npm/stylelint-config-rational-order@0.1.2 upgrade to: > 0.1.2
High	pkg:npm/chokidar@3.5.3 upgrade to: > 3.5.3
High	pkg:npm/@typescript-eslint/eslint-plugin@5.48.1 upgrade to: > 5.48.1
Informational	pkg:npm/ts-node@10.9.1 upgrade to: > 10.9.1
High	pkg:npm/@typescript-eslint/parser@5.48.1 upgrade to: > 5.48.1
High	pkg:npm/html-minifier@4.0.0 - no patch available
High	pkg:npm/google-fonts-complete@2.1.1 upgrade to: > 2.1.1
Medium	pkg:npm/svgo@3.0.0 upgrade to: 2.8.4,3.3.5,4.1.0
High	pkg:npm/npm-run-all@4.1.5 upgrade to: > 4.1.5
High	pkg:npm/postcss-inline-svg@5.0.0 upgrade to: > 5.0.0

More info on how to fix Vulnerable Libraries in JavaScript and Python.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

socket-security · 2026-09-11T14:12:23Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/postcss@8.4.21 ⏵ 8.5.28	⁺¹	⁺²⁶	^-4
	npm/stylelint@14.16.1 ⏵ 17.15.0	⁺¹			^-5

View full report

socket-security · 2026-09-11T14:12:25Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: npm `meow` under CC-BY-3.0 License: CC-BY-3.0 - The applicable license policy does not permit this license (5) (package/build/licenses.md) From: package-lock.json → `npm/stylelint@17.15.0` → `npm/meow@14.1.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/meow@14.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

mergify · 2026-09-11T14:13:06Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

Update stylelint to version 17.15.0

4ecd4a8

depfu Bot added the depfu label Sep 11, 2026

depfu Bot mentioned this pull request Sep 11, 2026

🚨 [security] Update stylelint 14.16.1 → 17.14.1 (major) #253

Closed

Navigation Menu

🚨 [security] Update stylelint 14.16.1 → 17.15.0 (major) - #264

🚨 [security] Update stylelint 14.16.1 → 17.15.0 (major)#264
depfu[bot] wants to merge 1 commit into
masterfrom
depfu/update/npm/stylelint-17.15.0

depfu Bot commented Sep 11, 2026

Uh oh!

bolt-new-by-stackblitz Bot commented Sep 11, 2026

Uh oh!

changeset-bot Bot commented Sep 11, 2026

Uh oh!

guardrails Bot commented Sep 11, 2026

Uh oh!

socket-security Bot commented Sep 11, 2026

Uh oh!

socket-security Bot commented Sep 11, 2026

Uh oh!

mergify Bot commented Sep 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

depfu Bot commented Sep 11, 2026

What changed?

✳️ stylelint (14.16.1 → 17.15.0) · Repo · Changelog

✳️ postcss (8.4.21 → 8.5.28) · Repo · Changelog

↗️ braces (indirect, 3.0.2 → 3.0.3) · Repo · Changelog

↗️ colord (indirect, 2.9.3 → 2.10.0) · Repo · Changelog

2.10.0 (from changelog)

2.9.7 (from changelog)

2.9.6 (from changelog)

2.9.5 (from changelog)

2.9.4 (from changelog)

↗️ debug (indirect, 4.3.4 → 4.4.3) · Repo · Changelog

↗️ fast-glob (indirect, 3.2.12 → 3.3.3) · Repo

↗️ fill-range (indirect, 7.0.1 → 7.1.1) · Repo

↗️ flatted (indirect, 3.2.4 → 3.4.4) · Repo

↗️ html-tags (indirect, 3.2.0 → 5.1.0) · Repo

↗️ meow (indirect, 9.0.0 → 14.1.0) · Repo

↗️ micromatch (indirect, 4.0.5 → 4.0.8) · Repo · Changelog

↗️ ms (indirect, 2.1.2 → 2.1.3) · Repo

↗️ nanoid (indirect, 3.3.4 → 3.3.19) · Repo · Changelog

↗️ picocolors (indirect, 1.0.0 → 1.1.1) · Repo · Changelog

↗️ source-map-js (indirect, 1.0.2 → 1.2.1) · Repo · Changelog

↗️ supports-hyperlinks (indirect, 2.3.0 → 4.5.0) · Repo

↗️ table (indirect, 6.8.1 → 6.9.0) · Repo

🆕 @​cacheable/memory (added, 2.2.0)

🆕 @​cacheable/utils (added, 2.5.0)

🆕 @​csstools/css-calc (added, 3.3.0)

🆕 @​csstools/css-parser-algorithms (added, 4.0.0)

🆕 @​csstools/css-syntax-patches-for-csstree (added, 1.1.13)

🆕 @​csstools/css-tokenizer (added, 4.0.0)

🆕 @​csstools/media-query-list-parser (added, 5.0.0)

🆕 @​csstools/selector-resolve-nested (added, 4.0.1)

🆕 @​keyv/bigmap (added, 1.3.1)

🆕 @​keyv/serialize (added, 1.1.1)

🆕 @​sindresorhus/merge-streams (added, 4.0.0)

🆕 cacheable (added, 2.5.0)

🆕 fast-uri (added, 3.1.7)

🆕 get-east-asian-width (added, 1.6.0)

🆕 hashery (added, 1.5.1)

🆕 hookified (added, 1.15.1)

🆕 import-meta-resolve (added, 4.2.0)

🆕 qified (added, 0.10.1)

🆕 unicorn-magic (added, 0.4.0)

🗑️ @​types/minimist (removed)

🗑️ @​types/normalize-package-data (removed)

🗑️ @​types/parse-json (removed)

🗑️ camelcase-keys (removed)

🗑️ hard-rejection (removed)

🗑️ known-css-properties (removed)

🗑️ map-obj (removed)

🗑️ min-indent (removed)

🗑️ minimist-options (removed)

🗑️ quick-lru (removed)

🗑️ read-pkg-up (removed)

🗑️ redent (removed)

🗑️ strip-indent (removed)

🗑️ trim-newlines (removed)

🗑️ v8-compile-cache (removed)

🗑️ yargs-parser (removed)

Uh oh!

bolt-new-by-stackblitz Bot commented Sep 11, 2026

Uh oh!

changeset-bot Bot commented Sep 11, 2026

⚠️ No Changeset found

Uh oh!

guardrails Bot commented Sep 11, 2026

Uh oh!

socket-security Bot commented Sep 11, 2026

Uh oh!

socket-security Bot commented Sep 11, 2026

Uh oh!

mergify Bot commented Sep 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

🆕 @cacheable/memory (added, 2.2.0)

🆕 @cacheable/utils (added, 2.5.0)

🆕 @csstools/css-calc (added, 3.3.0)

🆕 @csstools/css-parser-algorithms (added, 4.0.0)

🆕 @csstools/css-syntax-patches-for-csstree (added, 1.1.13)

🆕 @csstools/css-tokenizer (added, 4.0.0)

🆕 @csstools/media-query-list-parser (added, 5.0.0)

🆕 @csstools/selector-resolve-nested (added, 4.0.1)

🆕 @keyv/bigmap (added, 1.3.1)

🆕 @keyv/serialize (added, 1.1.1)

🆕 @sindresorhus/merge-streams (added, 4.0.0)

🗑️ @types/minimist (removed)

🗑️ @types/normalize-package-data (removed)

🗑️ @types/parse-json (removed)