From d923bd82b05b83ca54df4c5a330b62d196d4e489 Mon Sep 17 00:00:00 2001
From: fro-bot <80104189+fro-bot@users.noreply.github.com>
Date: Sat, 25 Jul 2026 06:02:26 +0000
Subject: [PATCH 1/2] fix(security): remediate PostCSS source map disclosure
 advisories (High)

Adds a pnpm override pinning postcss to ^8.5.18, the first version
patched against both GHSA-r28c-9q8g-f849 (path traversal via previous
sourceMappingURL auto-loading, fixed in 8.5.18) and GHSA-6g55-p6wh-862q
(arbitrary file read via attacker-controlled sourceMappingURL in CSS
comments, fixed in 8.5.12). postcss is a transitive dependency of vite
(devDependency); resolved version is now 8.5.22.

Verified: pnpm build and pnpm test pass with no regressions.
---
 pnpm-lock.yaml      | 17 +++++++++--------
 pnpm-workspace.yaml |  1 +
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1e72e82..33d2273 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -6,6 +6,7 @@ settings:
 
 overrides:
   fast-uri: ^3.1.3
+  postcss: ^8.5.18
 
 importers:
 
@@ -2107,8 +2108,8 @@ packages:
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
-  nanoid@3.3.11:
-    resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
+  nanoid@3.3.16:
+    resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -2196,8 +2197,8 @@ packages:
     resolution: {integrity: sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==}
     engines: {node: '>=4'}
 
-  postcss@8.5.10:
-    resolution: {integrity: sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==}
+  postcss@8.5.22:
+    resolution: {integrity: sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==}
     engines: {node: ^10 || ^12 || >=14}
 
   prelude-ls@1.2.1:
@@ -4889,7 +4890,7 @@ snapshots:
 
   ms@2.1.3: {}
 
-  nanoid@3.3.11: {}
+  nanoid@3.3.16: {}
 
   napi-postinstall@0.3.4: {}
 
@@ -4968,9 +4969,9 @@ snapshots:
 
   pluralize@8.0.0: {}
 
-  postcss@8.5.10:
+  postcss@8.5.22:
     dependencies:
-      nanoid: 3.3.11
+      nanoid: 3.3.16
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
@@ -5293,7 +5294,7 @@ snapshots:
       esbuild: 0.27.7
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
-      postcss: 8.5.10
+      postcss: 8.5.22
       rollup: 4.60.2
       tinyglobby: 0.2.16
     optionalDependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index b7609cd..b5d4cb6 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -15,3 +15,4 @@ strictPeerDependencies: false
 
 overrides:
   fast-uri: ^3.1.3
+  postcss: ^8.5.18

From 5c5787259ebe03825fa796633f5f3e890ba37910 Mon Sep 17 00:00:00 2001
From: fro-bot <80104189+fro-bot@users.noreply.github.com>
Date: Wed, 5 Aug 2026 06:10:08 +0000
Subject: [PATCH 2/2] fix(security): bump postcss override to ^8.5.23 (source
 map disclosure)

Dependabot alert #51 flagged that this PR's postcss override (^8.5.18,
resolving to 8.5.22) is still within the vulnerable range for an
incomplete-fix follow-up to the sourceMappingURL disclosure advisory
(Medium). Upstream fully patched it in 8.5.23; bump the pnpm override
to close the remaining exposure.
---
 pnpm-lock.yaml      | 10 +++++-----
 pnpm-workspace.yaml |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 33d2273..e4b6327 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -6,7 +6,7 @@ settings:
 
 overrides:
   fast-uri: ^3.1.3
-  postcss: ^8.5.18
+  postcss: ^8.5.23
 
 importers:
 
@@ -2197,8 +2197,8 @@ packages:
     resolution: {integrity: sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==}
     engines: {node: '>=4'}
 
-  postcss@8.5.22:
-    resolution: {integrity: sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==}
+  postcss@8.5.25:
+    resolution: {integrity: sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==}
     engines: {node: ^10 || ^12 || >=14}
 
   prelude-ls@1.2.1:
@@ -4969,7 +4969,7 @@ snapshots:
 
   pluralize@8.0.0: {}
 
-  postcss@8.5.22:
+  postcss@8.5.25:
     dependencies:
       nanoid: 3.3.16
       picocolors: 1.1.1
@@ -5294,7 +5294,7 @@ snapshots:
       esbuild: 0.27.7
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
-      postcss: 8.5.22
+      postcss: 8.5.25
       rollup: 4.60.2
       tinyglobby: 0.2.16
     optionalDependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index b5d4cb6..927df2a 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -15,4 +15,4 @@ strictPeerDependencies: false
 
 overrides:
   fast-uri: ^3.1.3
-  postcss: ^8.5.18
+  postcss: ^8.5.23