build(deps): lift the brace-expansion and postcss pins to clear two High advisories

[NiveditJain]

Why

The Supply Chain gate (OSV-Scanner) went red on every open PR, including branches that change no dependencies at all — #594 is three docs pages. Two High-severity advisories published after main's last green scan at 2026-07-24 15:12 UTC:

Advisory	CVSS	Package	Affected	Fixed
GHSA-mh99-v99m-4gvg — unbounded-expansion DoS (OOM crash)	7.5	brace-expansion	<= 5.0.7	5.0.8
GHSA-r28c-9q8g-f849 — path traversal in sourceMappingURL auto-loading, discloses arbitrary .map files	7.5	postcss	<= 8.5.17	8.5.18

Same shape as #587 and #591, but the remedy is narrower than either: both packages were already pinned in overrides by those PRs, and the vulnerable versions are the pins. Nothing else resolves them, so the entire fix is raising the two values.

What changed

• brace-expansion 5.0.7 → 5.0.8 — the only fixed 5.x. Keeps the single-pin-across-two-majors arrangement Give log-viewer rows a stable unique key, so messages stop stacking on top of each other #587 established (the minimatch@3 that eslint-plugin-import, -jsx-a11y and -react pull still declares ^1.1.7). A patch bump inside v5, so it carries none of that decision's original risk.
• postcss 8.5.14 → 8.5.23, not the minimum fixed 8.5.18 — the old pin sat below what its own dependents declare (@tailwindcss/postcss wants ^8.5.16, vite wants ^8.5.15), so the bump also stops the override silently forcing a version outside both ranges. Pulls nanoid 3.3.12 → 3.3.16 with it.

osv-scanner.toml is untouched and keeps its zero ignored vulnerabilities — this is a fix, not an allow-list entry.

Verification

postcss is a build-time dependency, so a green lockfile alone isn't enough:

• bun run build — completes (Next.js + Tailwind + dist/index.js, prune-standalone clean)
• bun run test:run — 2357 passed / 131 files
• bun run lint — clean, same five pre-existing warnings (this is the path brace-expansion is exercised on)
• CI's own scanner image ghcr.io/google/osv-scanner-action:v2.3.8 against the updated bun.lock: No issues found, exit 0

Notes

Merging this unblocks #594 and every other open PR; they'll need a rebase or re-run to pick up the green scan.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MmRdEWob5E8B5V1eEAo9WG

[coderabbitai]

Warning

Review limit reached

@NiveditJain, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 36 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3e941abe-576d-4dc2-991d-ab437b47e878

📥 Commits

Reviewing files that changed from the base of the PR and between 3c3c026 and 303da70.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• CHANGELOG.md
• package.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hermes-exosphere]

Verdict: Approved. Clean dependency pin bumps clearing two High advisories. All CI green, OSV-Scanner confirms fix. Full review in comment below.

[hermes-exosphere]

Code Review — PR #596

Verdict: [PASS] Approved

Clean dependency pin bump clearing two High-severity advisories. Three files changed, all CI green, OSV-Scanner confirms No issues found.

What changed

• brace-expansion 5.0.7 → 5.0.8 — patch bump inside v5. Fixes GHSA-mh99-v99m-4gvg (CVSS 7.5, unbounded-expansion DoS).
• postcss 8.5.14 → 8.5.23 — fixes GHSA-r28c-9q8g-f849 (CVSS 7.5, path traversal in sourceMappingURL). The bump goes past the minimum fixed 8.5.18 to land inside both @tailwindcss/postcss's ^8.5.16 and vite's ^8.5.15 ranges. Pulls nanoid 3.3.12 → 3.3.16 transitively.
• CHANGELOG.md — one new entry.

What I verified

• All 3 affected versions exist on npm (brace-expansion@5.0.8, postcss@8.5.23, nanoid@3.3.16)
• bun.lock checksums updated — 5 changed lines, all expected (the two overrides + the two package entries + nanoid)
• No secrets, debug statements, or merge conflict markers
• OSV-Scanner: pass (exit 0, No issues found)
• Build: pass (Next.js + Tailwind + dist/index.js)
• All test suites pass (unit: 2357 passed / 131 files, e2e: pass)
• Lint: clean
• Socket Security: pass
• Mergeable: yes

Notes

• This is the third supply-chain pin fix this month — same shape as Give log-viewer rows a stable unique key, so messages stop stacking on top of each other #587 and Repoint the integration suite's codex probe after codex-cli 0.145.0 started sending encrypted reasoning content #591 but narrower since both packages were already pinned.
• brace-expansion is exercised on the lint path (same 5 pre-existing warnings, no new ones).
• postcss is build-time only — verified with bun run build completing correctly.
• Merging this unblocks docs(agenteye): add OpenClaw and Hermes session capture pages #594 and any other open PRs that went red on the stale scanner baseline.

---

Reviewed by Hermes Agent