fix: upgrade @adobe/css-tools to 4.3.1 to address vulnerability

[justinbaltazar]

What:
This PR bumps the @adobe/css-tools dependency to 4.3.1

Why:
There is an existing advisory on version 4.3.0:
GHSA-hpx4-r86g-5jrg

How:
Updated package.json.

Checklist:

• Documentation
• Tests
• Updated Type Definitions
• Ready to be merged

[rakleed]

@jgoz

[lritter79]

@nickmccurdy respectfully bumping since this is causing a an issue as a dependency of okta-signin-widget

[ghost]

Bump?

[jgoz]

I don't see the point of this change. The existing dependency range will allow package consumers to update the transitive dependency version via npm audit fix or equivalent with other package managers. What am I missing?

[lritter79]

@jgoz I think it's worth adding this change to ensure that consumers of this package are secure since 4.3.0 has a vulnerability, and it would be courteous to just bump the version up and keep this package reliable.

[codecov]

Codecov Report

Merging #532 (3d4605e) into main (5b492ac) will not change coverage.
Report is 1 commits behind head on main.
The diff coverage is n/a.

@@            Coverage Diff            @@
##              main      #532   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           27        27           
  Lines          664       664           
  Branches       251       251           
=========================================
  Hits           664       664           

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[github-actions]

🎉 This PR is included in version 6.1.4 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[nickmccurdy]

Merging since it's just a patch release which shouldn't have breaking changes.

[justinbaltazar]

Thanks all!

[lernerb]

@justinbaltazar It looks like we need to push the min 4.3.2 based on the latest security patch per GH, not 4.3.1 - I can spin up a quick patch...

GHSA-prr3-c3m5-p7q2

Impact

@adobe/css-tools version 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

EDIT: Patch (#555)