Possible fix(deps): 4 vulnerable dependencies in pnpm-lock.yaml

[begininvoke]

This might be a false positive, but pnpm-lock.yaml around line 1 looked worth a second pair of eyes.

PostCSS 8.5.6 (pinned in pnpm-lock.yaml) is affected by CVE-2026-45623 (HIGH severity), fixed in 8.5.12. PostCSS's PreviousMap feature parses the /*# sourceMappingURL=PATH */ annotation from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme check, allowlist, or path-traversal validation. When an attacker controls the CSS input (user-uploaded themes/styles, CMS content, browser-extension/userstyle processors, blog comment renderers, or build pipelines over third-party code), they can make the host Node process read arbitrary files readable by that process, leak up to ~10 bytes of file content through a JSON.parse SyntaxError message, obtain a precise file-existence oracle, or combine the read with large-file targets for denial of service. Critically, the behavior triggers with PostCSS's default options — no from, map, or plugin configuration is required — so any pipeline running untrusted CSS through PostCSS is exposed. Because the finding is in the lockfile, simply widening the version range in package.json is insufficient; the lockfile must be regenerated with the patched version. Risk is HIGH for any service that processes untrusted or semi-trusted CSS, and lower (informational/hardening) if PostCSS only ever processes first-party, trusted source files.

Something like this might fix it:

# 1. Upgrade postcss to the fixed version and regenerate the lockfile:
$ pnpm update postcss@8.5.12

--- a/package.json
+++ b/package.json
@@ dependencies
-    "postcss": "^8.5.6",
+    "postcss": "^8.5.12",

--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ packages
-  postcss@8.5.6:
+  postcss@8.5.12:
     resolution: {integrity: sha512-...}

# 2. If postcss is only a transitive dependency, force the patched version with a pnpm override:
--- a/package.json
+++ b/package.json
@@
   "pnpm": {
+    "overrides": {
+      "postcss": "^8.5.12"
+    }
   }

# 3. Defense-in-depth (only until the upgrade lands): strip sourceMappingURL
#    annotations from untrusted CSS before passing it to PostCSS.
--- a/src/css-pipeline.js
+++ b/src/css-pipeline.js
@@
-  const result = postcss(plugins).process(untrustedCss, { from: filePath }).sync();
+  // Never let PreviousMap dereference an attacker-controlled path.
+  const sanitized = untrustedCss.replace(/\/\*#\s*sourceMappingURL=[^*]*\*\/\s*/g, '');
+  const result = postcss(plugins).process(sanitized, { from: filePath, map: false }).sync();

Note: upgrading to postcss >= 8.5.12 is the authoritative fix; input sanitization and map:false are temporary mitigations only. After patching, verify with: $ pnpm audit / $ pnpm why postcss

For reference: rule CVE-2026-45623. Rated high.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.