fix(security): raise the postcss override past its own ceiling

[saagpatel]

Summary

Changes the postcss override from the exact pin 8.5.10 to the range ^8.5.23, clearing all three open postcss advisories.

The pin had become the problem

overrides.postcss was set to exactly 8.5.10, forcing that version into all three consumers that pull postcss in: @tailwindcss/postcss, next, and vite.

That pin was added by "fix: patch decisionstresstest js advisories" (#25) as a floor, to drag postcss up past an advisory current at the time. Written as an exact version rather than a range, the floor became a ceiling. It has been holding postcss below every fix published since, including the earliest of the three now open against it:

Advisory	Severity	First patched	Pin was at
CVE-2026-45623	high	8.5.12	8.5.10
GHSA-r28c-9q8g-f849	high	8.5.18	8.5.10
CVE-2026-69153	medium	8.5.23	8.5.10

^8.5.23 clears all three and preserves the original intent, which was to hold postcss above known-vulnerable versions rather than at one specific version.

Scope

npm resolves this to 8.5.25 and dedupes in the process. The three nested copies under @tailwindcss/postcss, next, and vite collapse into a single hoisted postcss, dropping the package count from 613 to 611. The only other version change is nanoid 3.3.12 to 3.3.17, which postcss depends on.

Verification

Baseline captured at 8.5.10 before the change, identical after:

Gate	Before	After
npm run typecheck	clean	clean
npm test	106 tests, 35 files	106 tests, 35 files
npm run build	all routes compiled	all routes compiled

The ERESOLVE warnings npm prints during install are pre-existing and unrelated: eslint@^10 in the root against plugins from eslint-config-next that declare peers up to ^9. They are warnings, not errors, and predate this change.

Context for triaging the rest of these

The postcss advisories describe a service that accepts user-submitted CSS and runs it through PostCSS. Here postcss only runs inside the build toolchain over first-party CSS, so the realistic exposure is a dependency injecting CSS into the build, not anything reachable by a user of the app. GitHub scores it runtime because postcss sits in a production dependency tree, not because it ships to the client. Worth patching, not worth treating as an incident.

The same override-as-ceiling pattern exists in prompt-englab, capped at ^8.5.16.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.