fix(deps): patch HIGH/CRITICAL advisories (postcss CVE-2026-45623, CVE-2026-73646) #16

Merged

siax-bot merged 1 commits from fix/cve-lockfile-2026-09-30 into main

2026-10-01 15:52:18 +00:00

Author	SHA1	Message	Date
Claude CodeandClaude Sonnet 5.5	1258903289	fix(deps): patch HIGH advisories in postcss (CVE-2026-45623, CVE-2026-73646) CI (SIAX Cloud) / sonar (push) Skipped Details CI (SIAX Cloud) / sonar (pull_request) Skipped Details CI (SIAX Cloud) / security (push) Successful in 23s Details CI (SIAX Cloud) / security (pull_request) Successful in 16s Details CI (SIAX Cloud) / contracts (pull_request) Successful in 21s Details CI (SIAX Cloud) / contracts (push) Successful in 1m5s Details CI (SIAX Cloud) / quality (push) Successful in 1m26s Details CI (SIAX Cloud) / quality (pull_request) Successful in 1m22s Details next@15.5.x hard-pins postcss 8.4.31, so a plain lockfile update cannot reach the fix. Add a pnpm override (postcss@<8.5.18 -> 8.5.28, same major, already resolved for vite) so the whole tree uses one patched postcss. Lockfile diff is limited to dropping postcss 8.4.31 and repointing next. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-30 12:06:29 +02:00