fix(deps): override postcss to 8.5.18+ to clear two HIGH CVEs (#1235)

The daily lockfile SCA scan was failing on CVE-2026-45623 and GHSA-r28c-9q8g-f849, both disclosed 2026-07-27: PostCSS auto-loads a source map from an attacker-controlled sourceMappingURL comment, giving arbitrary .map file read on any CSS the toolchain does not fully trust.

Same nested-dependency shape as the sharp fix in #1223, and worse in one respect: next pins its own postcss@8.4.31, but the top-level was vulnerable too at 8.5.16 against a fix that landed in 8.5.18. One override collapses both onto 8.5.23 and drops the nested copy.

postcss is build-critical for Tailwind 4, so this was verified past 'tests pass': the production build succeeds and emits a 166 KB compiled CSS chunk with Tailwind utility classes intact. Full unit suite 11,359 passed.

This commit is contained in:

Jakob Wennberg

2026-07-27 14:27:18 +02:00

committed by

GitHub

parent 7dde8cac82

commit 922cf16227

2 changed files with 9 additions and 37 deletions

									
										package.json
									
		+2
		-1
	
												View File
												
				@@ -95,6 +95,7 @@

				  },

				  "overrides": {

				    "ws": "^8.21.0",

				    "sharp": "^0.35.3"

				    "sharp": "^0.35.3",

				    "postcss": "^8.5.18"

				  }

				}