nextjs - 💡(How to fix) Fix postcss bundled by next is vulnerable to XSS (GHSA-qx2v-qp2m-jg93) — please update to >=8.5.10 [1 comments, 2 participants]

TL;DR

Update the postcss version in the Next.js project to 8.5.10 or higher to fix the moderate severity findings.

Guidance

• Check the package.json file in the Next.js project to see if postcss is listed as a dependency, and if so, update the version to 8.5.10 or higher.
• Run npm install [email protected] or higher to update the postcss version.
• After updating, run npm audit --omit=dev again to verify that the moderate severity findings are resolved.
• Consider checking the Next.js documentation for any official guidance on updating dependencies.

Example

No code snippet is provided as it is not necessary for this issue.

Notes

The issue is specific to the postcss version used in the Next.js project, and updating to 8.5.10 or higher should resolve the moderate severity findings.

Recommendation

Apply workaround: Update the postcss version to 8.5.10 or higher, as this is a known fix for the GHSA-qx2v-qp2m-jg93 advisory.