build(deps): lift the brace-expansion and postcss pins to clear two High advisories

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ### Dependencies
 - Bump `next` to 16.2.11 and pin `sharp` to 0.35.0, clearing the ten advisories that turned the Supply Chain gate red on every open PR. Nine are Next.js (four High, CVSS 8.2-8.3: middleware/proxy bypass in App Router, SSRF in Server Actions, and others) fixed in 16.2.11; the tenth is `sharp`'s inherited libvips CVEs (GHSA-f88m-g3jw-g9cj, CVSS 7.0) fixed in 0.35.0. Same shape as the `brace-expansion` incident three days ago: the advisories published on 2026-07-21 and 2026-07-22, *after* `main`'s last green scan at 2026-07-21 14:07 UTC, so every branch went red at once with no dependency change of its own — re-running CI's scanner image against `main`'s unchanged lockfile reproduced the failure identically. The two halves need different tools. `next` is a direct devDependency whose `^16.2.9` range already admitted the fix, so `bun update next` lifts it (and raises the declared floor to `^16.2.11`, so it cannot resolve back). `sharp` cannot be fixed that way: it is an *optional* dependency of `next`, and `next@16.2.11` still declares `sharp: ^0.34.5` — a range that excludes 0.35.0 — so updating `next` leaves the advisory in place and the pin has to come from `overrides`, the same plain-key mechanism already holding `postcss`, `vite`, `undici` and `brace-expansion`. Forcing a *minor* bump of a native library under a dependent asking for `^0.34.5` is the risk here, so it was verified beyond a green lockfile: `sharp` 0.35.0 loads against libvips 8.18.3 and round-trips an encode (`@img/sharp-libvips-linux-x64` moves 1.2.4 → 1.3.0). Confirmed with CI's own scanner image (`ghcr.io/google/osv-scanner-action:v2.3.8`) against the updated lockfile: `No issues found`, exit 0, with `osv-scanner.toml` keeping its zero ignored vulnerabilities. (#591)
+- Lift the `brace-expansion` pin to 5.0.8 and the `postcss` pin to 8.5.23, clearing the two High-severity advisories that turned the Supply Chain gate red on every open PR for the third time this month. GHSA-mh99-v99m-4gvg (CVSS 7.5) is an unbounded-expansion DoS in `brace-expansion` `<= 5.0.7`, fixed in 5.0.8; GHSA-r28c-9q8g-f849 (CVSS 7.5) is a path traversal in `postcss`'s `sourceMappingURL` auto-loading that discloses arbitrary `.map` files, affecting `<= 8.5.17` and fixed in 8.5.18. Same shape as #587 and #591: both advisories published *after* `main`'s last green scan at 2026-07-24 15:12 UTC, so branches carrying no dependency change of their own — #594 is three docs pages — went red simultaneously. The remedy is narrower than either predecessor, because both packages were **already** pinned in `overrides` by those PRs and the vulnerable versions are the pins themselves; nothing resolves them but the pin, so the entire fix is to raise the two values. `brace-expansion` goes to 5.0.8, the only fixed 5.x, keeping the single-pin-across-two-majors arrangement #587 established (the `minimatch@3` that `eslint-plugin-import`, `-jsx-a11y` and `-react` pull still declares `^1.1.7`) — a patch bump inside v5, so it carries none of that decision's original risk, and lint still runs clean with the same five pre-existing warnings. `postcss` goes to 8.5.23 rather than the minimum fixed 8.5.18 because the old 8.5.14 pin was *below* what its own dependents ask for — `@tailwindcss/postcss` declares `^8.5.16` and `vite` `^8.5.15` — so the bump also stops the override silently forcing a version outside both ranges; it pulls `nanoid` 3.3.12 → 3.3.16 with it. Verified beyond a green lockfile, since `postcss` is a build-time dependency: `bun run build` completes (Next.js + Tailwind + `dist/index.js`) and all 2357 unit tests pass. Confirmed with CI's own scanner image (`ghcr.io/google/osv-scanner-action:v2.3.8`) against the updated lockfile: `No issues found`, exit 0, with `osv-scanner.toml` keeping its zero ignored vulnerabilities. (#596)
 
 ### Features
 - Probe each agent CLI's public pre-release build alongside the one users get, so the integration suite reports not only "is enforcement broken?" but "is it about to break, and how long do we have?". The workflow becomes a matrix over `CANARY_CHANNEL`: the `stable` leg is unchanged (all 12 CLIs, a `FAIL` still fails the job) and a new `beta` leg installs each vendor's pre-release ref. The motivating measurement: codex shipped the payload change that broke the 2026-07-22 run in `0.145.0-alpha.4` on 2026-07-11 but did not release it until 2026-07-21 — **10.7 days** of warning, established by installing each alpha and capturing its request body against a mock endpoint. Six CLIs publish something usable: codex `alpha`, copilot `prerelease`, openclaw `beta`, cursor `?channel=lab` (server-validated; `beta`/`canary` are rejected with HTTP 400), goose `CANARY=true` (a *rolling tag* marked `prerelease: false`, so channel detection scanning for `prerelease: true` misses it), and claude — which runs **backwards**: nothing ships ahead of `latest`, so the stable leg now pins `bash -s stable` (~13 days behind, and what conservative users actually run) and `latest` becomes the early-warning ref. That pin also stops a same-day Anthropic release, which lands ~daily, from red-lighting a PR that touched nothing. The other six are deliberately skipped rather than re-installed at stable and reported as coverage: factory, antigravity and pi publish no pre-release at all (verified — antigravity has 19 releases with zero prereleases and its updater serves the identical stable manifest for every `?channel=` value); opencode's `beta`/`dev` tags are ~31 branch snapshots a day rather than release candidates; devin's unpromoted builds exist but cannot be listed, only guessed at; and hermes's installer git-clones `main`, which is also what every hermes user gets, so there is nothing ahead of us to probe. Coverage is stated in the report itself (`watching 6/12`) because a pre-release ref does not preview every release — codex only alphas minor bumps, so all six recent `0.144.x` patches shipped blind, and the copilot 1.0.70 silent-allow had just 0.6 days of lead. (#591)

package.json

@@ -103,11 +103,11 @@
     "yaml": "^2.9.0"
   },
   "overrides": {
-    "postcss": "8.5.14",
+    "postcss": "8.5.23",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
     "undici": "7.28.0",
-    "brace-expansion": "5.0.7",
+    "brace-expansion": "5.0.8",
     "sharp": "0.35.0"
   }
 }