security: bump postcss past path-traversal advisory (GHSA-r28c-9q8g-f849, high)

[schmug]

Task

Bump postcss from 8.5.15 to >8.5.17 to fix GHSA-r28c-9q8g-f849 (high) — a path-traversal issue where postcss auto-loads an external .map file referenced by an untrusted sourceMappingURL comment, allowing arbitrary file disclosure.

Pointers

package-lock.json → node_modules/postcss (transitive dependency — run npm ls postcss to confirm the parent(s) pulling it in).

Constraints

Scope to this one dependency. If no direct manifest entry exists, an overrides entry in package.json pinning postcss to >8.5.17 is the safe path. Run npm run typecheck, npm run lint, and npm test and keep green.

Acceptance

npm audit no longer reports GHSA-r28c-9q8g-f849; full test/lint/typecheck suite green.

Out of scope

hono advisory (tracked separately, see companion issue). brace-expansion and the wrangler/miniflare/sharp chain are already covered by open Dependabot PRs #648 and #635 — do not duplicate.

[schmug]

Superseded — closing as part of retiring the weekly security sweep cloud routine.

This issue was filed by that routine, which re-derived npm audit / pip-audit output every Monday and filed it as a GitHub issue. Dependabot alerts and automated security fixes are already enabled on this repo and track the same advisory, so this was duplicate tracking with no drain: since 2026-06-29 the routine filed 62 issues across 5 repos and 6 were ever closed (none after 2026-07-06), while Dependabot merged 13 PRs over the same window.

The advisory itself is not dismissed — it stays tracked as a Dependabot alert, which is the system that can also open the fix PR. If a specific advisory needs work Dependabot cannot do, file it fresh with that reason stated.