There's currently a node.js vulnerability in the braces package required indirectly by stylelint (stylelint > micromatch > braces).
It's fixed by upgrading stylelint to 9.8.0, which requires the micromatch version that first requires the fixed braces.
Affected extensions (per Github alert):
There are hundreds of repos which have an old version of stylelint, because we've not done the batch run yet. See T225325 item 1.3.1. :-) Nothing to stop you doing it early in a few repos, but the bot will get to it eventually.
Ah -- there's a bot for this. Are the GitHub alerts more or less safe to ignore, then?
LibUp "should" let us keep on top of things, but it's not perfect. In this case, it's low risk, so yes.