🚨 [security] Update @astrojs/cloudflare 13.7.0 → 14.1.3 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ @​astrojs/cloudflare (13.7.0 → 14.1.3) · Repo · Changelog

↗️ @​emnapi/runtime (indirect, 1.10.0 → 1.11.1) · Repo

Release Notes

1.11.1

What's Changed

• fix: refresh stale shared memory buffer before atomic access (v1.x backport) by @Brooooooklyn in #218

New Contributors

• @Brooooooklyn made their first contribution in #218

Full Changelog: v1.11.0...v1.11.1

1.11.0

What's Changed

• feat: add napi_create_external_sharedarraybuffer (#211)
• feat: support SharedArrayBuffer in napi_create_typedarray (#212)
• refactor: remove use of PThread.runningWorkers (#216)

Full Changelog: v1.10.0...v1.11.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 8 commits:

• 1.11.1
• fix: refresh stale shared memory buffer before atomic access (v1.x backport) (#218)
• 1.11.0
• refactor: remove use of PThread.runningWorkers (#216)
• ci: workflow_dispatch
• feat: support SharedArrayBuffer in napi_create_typedarray (#212)
• feat: add napi_create_external_sharedarraybuffer (#211)
• test: sync tsfn abort test

↗️ nanoid (indirect, 3.3.12 → 3.3.16) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 13 commits:

• Release 3.3.16 version
• fix(non-secure): clamp negative size to prevent infinite loop (#601)
• Update CI action
• Do not create latest release for v3
• Release 3.3.15 version
• Fix tag for v3
• Back-port new release system and fix pre-commit hook
• Release 3.3.14 version
• Another way to deal with pool damage
• Reduce ID size
• Fix pnpm 11 support
• Release 3.3.13 version
• Ignore .claude in npm

↗️ postcss (indirect, 8.5.14 → 8.5.24) · Repo · Changelog

Security Advisories 🚨

🚨 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Vulnerability Details

File: lib/previous-map.js
Line: 87-98 (loadFile), 129-144 (loadMap)

Root Cause

PostCSS auto-detects a /*# sourceMappingURL=... */ comment inside the CSS text it is asked to parse and, unless the caller explicitly passes map: false, attempts to load that path from disk as a "previous source map." This happens on every postcss.parse() / postcss().process() call by default (opt-out, not opt-in).

loadMap() builds the candidate path via join(dirname(opts.from), annotation), where annotation is the raw, attacker-controlled string from the CSS comment. path.join() normalizes but does not sandbox .. segments, so a ../../../ prefix walks the resolved path outside the intended directory. If opts.from is not set at all, the annotation is used completely unmodified — an absolute path in the CSS comment is read verbatim.

8.5.12 already fixed a strictly worse variant of this (any file, any extension, could be read) by requiring the resolved path to end in .map (loadFile()). That fix did not address the traversal itself, only the target extension. Since the join(dirname(file), map) logic has existed unchanged since PostCSS 8.0.0 (Feb 2020), any file ending in .map remains readable through this path in the current release (8.5.16).

Once loaded, MapGenerator.isMap() treats the mere presence of a loaded "previous map" as an implicit request to generate result.map, even when the caller never set the map option. If the loaded map has a sourcesContent field (common for maps emitted by bundlers/transpilers), that content is merged into result.map and returned to the caller — disclosing the traversed-to file's content to whoever supplied the CSS.

Attack Scenario

1. A service accepts user-submitted CSS and runs it through PostCSS to lint/format/transform it, e.g. postcss().process(userCss, { from: '/app/uploads/user123/input.css', to: '/app/uploads/user123/output.css' }) — idiomatic usage; map option untouched.
2. Attacker submits CSS containing /*# sourceMappingURL=../../../../some/other/app/dist/bundle.js.map */ (or an absolute path if from is unset).
3. PostCSS reads that .map file and folds its sourcesContent into result.map.
4. The service does what most build pipelines do with a truthy result.map — writes it next to the CSS output or returns it via API (source maps are meant to be consumed by browser devtools, so this is commonly public/served).
5. Attacker retrieves the emitted map and reads out the traversed file's content.

Impact

Disclosure of the contents of arbitrary .map files reachable via path traversal (or absolute path when from is unset) from the process's filesystem. Affects any application processing CSS it does not fully trust without explicitly passing map: false. No authentication or user interaction beyond submitting CSS text is required.

Vulnerable Code

loadFile(path, cssFile, trusted) {
  if (!trusted && !this.unsafeMap) {
    if (!/\.map$/i.test(path)) {
      return undefined
    }
  }
  this.root = dirname(path)
  if (existsSync(path)) {
    this.mapFile = path
    return readFileSync(path, 'utf-8').toString().trim()
  }
}
loadMap(file, prev) {

...

} else if (this.annotation) {

let map = this.annotation

if (file) map = join(dirname(file), map)

let unknown = this.loadFile(map, file, false)

...

}

}

Recommended Fix

Constrain the resolved path to remain inside the CSS file's own directory instead of relying solely on a filename-extension check:

loadFile(path, cssFile, trusted) {
  if (!trusted && !this.unsafeMap) {
    if (!/\.map$/i.test(path)) {
      return undefined
    }
    if (!cssFile) return undefined
    let root = resolve(dirname(cssFile))
    let resolvedPath = resolve(root, path)
    if (resolvedPath !== root && !resolvedPath.startsWith(root + sep)) {
      return undefined
    }
  }
  this.root = dirname(path)
  if (existsSync(path)) {
    this.mapFile = path
    return readFileSync(path, 'utf-8').toString().trim()
  }
}

I've implemented, tested (full existing test suite — 660/660 passing, plus new PoC-based regression checks for both the traversal and legitimate same-directory cases), and can share this fix on request or via a private fork if invited.

Verification

Dynamically confirmed on v8.5.16 (current npm release / repo HEAD) via a standalone Node.js harness against lib/postcss.js: a "secret" .map file placed two directories outside a simulated project directory was read via a crafted sourceMappingURL comment in otherwise-innocuous CSS, with its sourcesContent appearing verbatim in result.map.toString() — with no map option set by the caller. A second harness confirmed the simpler no-from case reads an absolute path directly. A third harness confirmed map: false is the only current workaround. The attached fix branch closes both vectors while keeping all 660 existing unit tests green.

Release Notes

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).
• Fixed docs (by @isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @sarathfrancis90).
• Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

• Fixed Input#origin() position (by @mizdra).
• Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @MahinAnowar).
• Fixed computing offset in positionBy() (by @greymoth-jp).
• Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @homanp).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 74 commits:

• Release 8.5.24 version
• Update dependencies
• Preserve the BOM when stringifying (#2119)
• Fix types check
• Release 8.5.23 version
• Update dependencies
• Does no load source map file without opts.from
• Typo
• Update EM banner
• Update EM banner
• Release 8.5.22 version
• Fix custom property losing its semicolon before a comment (#2117)
• Release 8.5.21 version
• Update dependencies
• Fix childless at-rule losing its semicolon before a comment (#2115)
• Fix mismatched JSDoc comments on Position (#2114)
• Release 8.5.20 version
• Fix missing space when AtRule#params is set after parsing (#2113)
• Update dependencies
• Move back to latest 11 pnpm
• Update pnpm to check that CI is fixed
• Rebuild nodes from another PostCSS copy in Warning (#2112)
• Improve CI security
• Remove patch after updating dependency
• Release 8.5.19 version
• Fix CI on Windows too
• Keep explicitly set raws.before when inserting nodes into root (#2111)
• Temporary fix CI
• Release 8.5.18 version
• Update dependencies
• Limit where source map can be loaded for security reasons
• Release 8.5.17 version
• Fix Maximum call stack size exceeded error
• Fix linter
• Fix CI
• Prevent prototype hijacking in fromJSON
• Update dependencies
• Fix non-closed `<div align="center">` in README (#2110)
• Remove old sponsors
• docs: fix invalid JS in writing-a-plugin examples (#2107)
• Fix `Input#origin()` mixing null and undefined for unmapped end position (#2106)
• Release 8.5.16 version
• Update formatting
• Fix `Input#origin()` returning incorrect position (#2036)
• Fix tests
• Don't clone root-less child nodes in container constructor (#2097)
• Revert version update to fix old Node.js on CI
• Update dependencies
• Preserve node raws when rehydrating a JSON AST (#2100)
• Fix Node#rangeBy() ignoring index 0 (#2091)
• Fix Node.js 26 tests
• Move to new publish process
• Update CI
• Move to Node.js 26 on CI
• Move to public Dev Container
• fix(node): always include offset in positionBy() like rangeBy() (#2099)
• Add postcss-nth-nested to plugins list (#2098)
• Add a version of Atlas Cloud banner (#2093)
• Release 8.5.15 version
• Update CI actions
• Speed up declaration parsing by avoiding creating new array on each token
• Fix code format
• Update dependencies
• Install older pnpm action for old Node.js
• Revert pnpm action for old Node.js
• Update CI actions
• Fix linter warnings
• Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
• Address review: source-map dict tokens and oxfmt formatting
• Add OSS-Fuzz fuzzing harness under test/fuzzing/
• Remove image since WIkipedia stopped to serve it to third parties
• Fix to another link
• Fix image URL
• Fix CI

🆕 @​emnapi/core (added, 1.11.1)

🆕 @​emnapi/wasi-threads (added, 1.2.2)

🆕 @​napi-rs/wasm-runtime (added, 1.2.0)

🆕 @​oxc-project/types (added, 0.139.0)

🆕 @​rolldown/binding-android-arm64 (added, 1.1.5)

🆕 @​rolldown/binding-darwin-arm64 (added, 1.1.5)

🆕 @​rolldown/binding-darwin-x64 (added, 1.1.5)

🆕 @​rolldown/binding-freebsd-x64 (added, 1.1.5)

🆕 @​rolldown/binding-linux-arm-gnueabihf (added, 1.1.5)

🆕 @​rolldown/binding-linux-arm64-gnu (added, 1.1.5)

🆕 @​rolldown/binding-linux-arm64-musl (added, 1.1.5)

🆕 @​rolldown/binding-linux-ppc64-gnu (added, 1.1.5)

🆕 @​rolldown/binding-linux-s390x-gnu (added, 1.1.5)

🆕 @​rolldown/binding-linux-x64-gnu (added, 1.1.5)

🆕 @​rolldown/binding-linux-x64-musl (added, 1.1.5)

🆕 @​rolldown/binding-openharmony-arm64 (added, 1.1.5)

🆕 @​rolldown/binding-wasm32-wasi (added, 1.1.5)

🆕 @​rolldown/binding-win32-arm64-msvc (added, 1.1.5)

🆕 @​rolldown/binding-win32-x64-msvc (added, 1.1.5)

🆕 @​rolldown/pluginutils (added, 1.0.1)

🆕 @​tybys/wasm-util (added, 0.10.3)

🆕 lightningcss (added, 1.33.0)

🆕 lightningcss-android-arm64 (added, 1.33.0)

🆕 lightningcss-darwin-arm64 (added, 1.33.0)

🆕 lightningcss-darwin-x64 (added, 1.33.0)

🆕 lightningcss-freebsd-x64 (added, 1.33.0)

🆕 lightningcss-linux-arm-gnueabihf (added, 1.33.0)

🆕 lightningcss-linux-arm64-gnu (added, 1.33.0)

🆕 lightningcss-linux-arm64-musl (added, 1.33.0)

🆕 lightningcss-linux-x64-gnu (added, 1.33.0)

🆕 lightningcss-linux-x64-musl (added, 1.33.0)

🆕 lightningcss-win32-arm64-msvc (added, 1.33.0)

🆕 lightningcss-win32-x64-msvc (added, 1.33.0)

🆕 rolldown (added, 1.1.5)

🆕 @​astrojs/internal-helpers (added, 0.10.1)

🆕 picomatch (added, 4.0.5)

🆕 tinyglobby (added, 0.2.17)

🆕 vite (added, 8.1.5)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	head-start	c23984a	Jul 28 2026, 09:55 AM

[cloudflare-workers-and-pages]

Deploying head-start with    Cloudflare Pages

Latest commit:	53af908
Status:	🚫  Build failed.

View logs