[superagent-security]

Superagent dependency review

Dependency change

Package	Change	Age
postcss-selector-parser	7.1.5 → 7.1.6	52 days

Question	Result
Is the update vulnerable or malicious?	✅ No issues found
Is this dependency used?	🛠️ Yes, development/CI only — No repo source imports the package. It is reachable only through the shadcn@4.18.0 CLI, which apps/web declares in dependencies and configures via components.json (a component generator run by developers, not imported by app code). Docker builds only @openmetal/api and @openmetal/worker, so the package is not in the deployed runtime; no request path parses untrusted selectors.

Why this update matters

The current version's repository impact could not be confirmed. See the candidate assessment and its limitations below.

Issue details

• Current version: GHSA-rj75-hqrm-r3gf — Not yet confirmed. No supported repository applicability evidence was provided for this advisory.

What we checked

No compromise or malicious behavior found in 7.1.6. The shipped tree differs from 7.1.5 only in dist/parser.js (Set-based linear parsing fix), the version field and CHANGELOG.md. Entry point, dependency declarations and lifecycle scripts are unchanged and benign; no credential access, network, process spawn, dynamic loader or obfuscation was observed in either target. Suspected risk: none; unresolved suspicious behavior: none.

• postcss-selector-parser@7.1.6: reviewed files — done; checked installation — not confirmed; ran the package — not confirmed; compared with the current version — done.
  • Static source review only; the package was not installed or executed (installTested/runtimeTested false by policy).
  • Behavioural equivalence of the Set-based rewrite was assessed by source reading and per-range hash comparison, not by running the parser.
  • Upstream advisory text, CHANGELOG and repository docs were treated as untrusted data and used only as context.
  • base execution unavailable: Exact package is not present in a successfully installed frozen repository tree.
  • candidate execution unavailable: Exact package is not present in a successfully installed frozen repository tree.
• Current source: 7bb2c963cfb7; update source: 0282fb2c9a57.

Release notes

v7.1.6

Compare Source

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openmetal	Ready	Preview	Oct 26, 2026 2:40am UTC

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.