GHSA-r28c-9q8g-f849 (postcss source-map path traversal) — RESOLVED: bumped 8.5.16 → 8.5.25 #124

Resolved 2026-08-02. postcss bumped 8.5.16 → 8.5.25 in #131. The advisory is cleared
and npm audit no longer reports it. Details below; the original assessment is preserved
underneath and still reads correctly — nothing in it was wrong, only its expectation that
Dependabot would propose the bump.

Resolution (2026-08-02)

Bumped postcss 8.5.16 → 8.5.25 in frontend/package.json, lock regenerated with npm.

Why it was applied by hand

This issue said "Dependabot targets dev for version updates and should propose it; if it does
not, apply it directly." It did not. After #126, #127 and #128 were closed there were no open
Dependabot PRs at all, so nothing was coming to do this automatically — and a HIGH advisory
waiting on a bot that is not going to act is worse than a four-line diff. The earlier plan to defer
it to its own PR was wrong for the same reason.

Which version actually clears it — verified in the source

The advisory reports affected <=8.5.17, first patched 8.5.18. That number was checked, not
taken, because GHSA-mh99-v99m-4gvg was re-scoped mid-flight and #125 was wrong as a direct result
(CLAUDE.md § Dependency hygiene — advisory metadata is evidence, not proof).

Unpacking the published tarballs, lib/previous-map.js's loadFile() in 8.5.18 gains the
containment check the advisory describes, and 8.5.17 has none of it:

if (cssFile) {
  let relativePath = relative(dirname(cssFile), path)
  if (relativePath === '..' || relativePath.startsWith('..' + sep) || isAbsolute(relativePath)) {
    return undefined
  }
}

A sourceMappingURL can no longer resolve outside the stylesheet's own directory — exactly the
"path traversal in previous source map auto-loading" the advisory names. 8.5.18 is therefore the
real fix floor, established independently of the version range.

8.5.25 was pinned rather than 8.5.18. The same check is still present there (relativePath
renamed to rel, semantics identical), it is the current release on the pinned 8.5 major, and
CLAUDE.md § Dependency hygiene asks for current, actively-maintained pins rather than the bare
minimum that clears a finding.

No overrides entry, no parent bump

Worth correcting one assumption: postcss is a direct devDependency here, not only a
transitive one under the vite/Mantine tree. Every package that also reaches it declares a peer or
caret range that 8.5.25 satisfies:

So raising the single direct pin lifts the whole tree — npm ls postcss --all shows every consumer
deduped onto one 8.5.25 copy. No overrides entry was needed and no parent package was bumped,
so the "stop if this needs a major bump of a parent" condition never arose.

The diff

Regenerated with npm pkg set + npm install --package-lock-only — not by editing version strings
— so resolved URLs and integrity hashes moved with the version:

• postcss 8.5.16 → 8.5.25
• its nanoid floor ^3.3.12 → ^3.3.16, pulling nanoid 3.3.15 → 3.3.16

All dev: true. No new packages.

Verification

• npm ci installs 8.5.25, and the installed node_modules/postcss/lib/previous-map.js carries
  the containment check.
• ESLint ✅ · Prettier ✅ · Vitest 20 files / 69 tests ✅ · npm run build ✅
• npm audit no longer reports postcss. The two remaining highs are the
  react-router / react-router-dom pair tracked in GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF bypass) — fixed by the 7.18.2 backport, not the 8.3.0 major #123.

What this did not change

PostCSS runs during vite build; the runtime image copies only the built dist/ output. No
deployed Scrye was ever exposed, and nothing about the shipped image changes — the reachability
assessment below was correct and this bump does not alter it. The value here is closing a HIGH
finding that would otherwise sit in every future npm audit and re-scan, not remediating live
risk.

Closed on this issue's own stated criterion: "close by hand once postcss is pinned at 8.5.25+
and the frontend build and Vitest suite pass."

Ref: #131, docs/ARCHIVE.md §14 (2026-08-02), CLAUDE.md § Dependency hygiene.