USWDS-Site - POAM: January ‘25

[cathybaptista]

Summary

Updated vulnerable dependencies.

Breaking change

This is not a breaking change.

Related issue

USWDS-Team - POAM: January '25

Preview link

Preview link →

Major changes

Before:

3 vulnerabilities (3 moderate)

After:

3 vulnerabilities (3 moderate)

Testing and review

1. Pull down and run npm install
2. Confirm no installation errors
3. Confirm no build errors
4. Run npm run test
5. Confirm no testing or linting errors
6. Start local or visit preview link
7. Confirm there are no visual regressions.

Dependency updates

Gem updates

Dependency name	Old version	New version
bigdecimal	3.1.8	3.1.9
ffi	1.17.0-arm64-darwin	1.17.1-arm64-darwin
google-protobuf	4.29.1-arm64-darwin	4.29.3-arm64-darwin
json	2.9.0	2.9.1
nokogiri	1.17.2-arm64-darwin	1.18.1-arm64-darwin
sass-embedded	1.83.0-arm64-darwin	1.83.1-arm64-darwin

Node updates

Dependency name	Old version	New version
postcss	^8.4.49	^8.5.0
sass	^1.83.0	^1.83.1
snyk	^1.1294.3	^1.1295.0

[mahoneycm]

LGTM!

• No observed regressions
• Install and tests run without error
• No additional updates available

New vulnerability popped up

[mahoneycm]

@cathybaptista since we updated in compile, can we resolve this new undici vulnerability that's showing up now?

https://github.com/uswds/uswds-site/security/dependabot/92