Security audit: braces (GHSA-vfj7-8cjw-p6xm) through the Tailwind CLI's file watcher #708

New issue

Closed

opened 2026-10-03 02:29:04 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-03 02:29:04 +00:00

Owner

The security audit went red on 0df9c342e (run 641): npm audit reports GHSA-vfj7-8cjw-p6xm, a stack-exhaustion denial of service in braces through deeply nested patterns, high severity. It reaches the build through @tailwindcss/cli 4.3.3 → @parcel/watcher 2.5.1 → micromatch → braces.

Node is only used to build the committed stylesheet and icons; nothing of it runs in the application. The watcher is only used by watch:css. So the exposure is a developer's machine and CI, not an instance. The audit is right to be red all the same.

Fix

@parcel/watcher 2.6.0 no longer depends on micromatch (it uses picomatch). npm audit fix reaches it by downgrading @tailwindcss/cli and tailwindcss to 4.3.0, which could change the compiled stylesheet. Instead, an overrides entry in package.json pins @parcel/watcher to ^2.6.0 and leaves Tailwind at 4.3.3. npm audit then finds nothing, and npm run build:css gives the committed stylesheet byte for byte.

Drop the override once @tailwindcss/cli depends on a fixed watcher itself.

The security audit went red on `0df9c342e` (run 641): `npm audit` reports GHSA-vfj7-8cjw-p6xm, a stack-exhaustion denial of service in `braces` through deeply nested patterns, high severity. It reaches the build through `@tailwindcss/cli` 4.3.3 → `@parcel/watcher` 2.5.1 → `micromatch` → `braces`. Node is only used to build the committed stylesheet and icons; nothing of it runs in the application. The watcher is only used by `watch:css`. So the exposure is a developer's machine and CI, not an instance. The audit is right to be red all the same. ## Fix `@parcel/watcher` 2.6.0 no longer depends on `micromatch` (it uses `picomatch`). `npm audit fix` reaches it by **downgrading** `@tailwindcss/cli` and `tailwindcss` to 4.3.0, which could change the compiled stylesheet. Instead, an `overrides` entry in `package.json` pins `@parcel/watcher` to ^2.6.0 and leaves Tailwind at 4.3.3. `npm audit` then finds nothing, and `npm run build:css` gives the committed stylesheet byte for byte. Drop the override once `@tailwindcss/cli` depends on a fixed watcher itself.

tiagoagueda added this to the 0.5.0 milestone

2026-10-03 02:29:04 +00:00

tiagoagueda added the

security

bug

labels

2026-10-03 02:29:04 +00:00

tiagoagueda referenced this issue from a commit

2026-10-03 02:30:36 +00:00

Pin the Tailwind CLI's file watcher past the braces advisory

tiagoagueda closed this issue

2026-10-03 02:30:36 +00:00