fix(deps): bump postcss to 8.5.24 (GHSA-r28c-9q8g-f849, unreported by dependabot)

[yakimoto]

User description

User description

Clears a HIGH that Dependabot is not reporting. Lockfile only — 7 lines.

postcss  8.5.15 → 8.5.24    (dev scope, via tsup + vite)
nanoid   3.3.12 → 3.3.16    (required by postcss's new range ^3.3.16)

The advisory

GHSA-r28c-9q8g-f849 — PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure. HIGH, range <= 8.5.17, first patched 8.5.18, published 2026-07-24.

It is in the GitHub Advisory Database — I read it straight from the API:

$ gh api graphql -f query='{securityVulnerabilities(ecosystem:NPM, package:"postcss", …)}'
GHSA-r28c-9q8g-f849 HIGH range=<= 8.5.17 fix=8.5.18 pub=2026-07-24T16:24:55Z

But this repo's Dependabot alert list has only brace-expansion and esbuild. The push that created this branch said so itself:

remote: GitHub found 2 vulnerabilities on wave-av/sdk's default branch (1 high, 1 low).

Two, not three. So this one was reachable only by running the audit — which is how I found it, while measuring the baseline for #53.

I checked whether the silence just meant "no postcss here." It doesn't. Reading origin/main refs rather than working trees:

repo	postcss on origin/main	Dependabot alert
sdk	8.5.15	none
sdks (sdk-typescript/pnpm-lock.yaml)	8.5.15	none
mcp-server	absent	none (correct)
adk	absent	none (correct)

Both repos that actually carry a vulnerable postcss have no alert; the two clean repos correctly have none. That's a detection gap, not absence — filed separately as wave-av/claude-workstation#564. sdks needs the same bump and does not have it yet.

Scope

Dev-only. postcss is a peer of the build toolchain and never enters the published dependency graph of @wave-av/sdk:

$ npm why postcss
postcss@8.5.15 dev
  peerOptional postcss@">=8.0.9" from postcss-load-config@6.0.1 → tsup@8.5.1
  peerOptional postcss@"^8.4.12" from tsup@8.5.1
  postcss@"^8.5.15" from vite@8.0.16

The exploit path is a malicious sourceMappingURL comment in CSS the toolchain processes. This SDK ships no CSS, so the practical exposure is low — but it's a HIGH in the build path, the fix is seven lines, and there's no reason to carry it.

Landing on 8.5.24 (current latest) rather than the minimum 8.5.18, since npm update resolves within the declared range and the intermediate releases are patch-level.

Verification

CI can't run — Actions are refusing every job org-wide on an account-level billing lock (plan=free, locked=yes, re-confirmed live today). All local, Node 22.14.0:

npm run build       → success        ← the one that matters; postcss is in the build path
npm run lint        → clean (--max-warnings 0)
npm run type-check  → clean
npm test            → 90 tests / 2 files, 0 failed

Advisory delta, dev scope included, against main @ e3864a7:

	total	high	low
main	3	2	1
this PR	2	1	1

The remaining high is brace-expansion, which #53 clears. With both landed the repo is down to one dev-only esbuild low.

Measurement caveat: this workstation exports NODE_ENV=production, which makes npm audit inherit omit=dev and hide dev-scope entries entirely — including both of these. Every figure above was taken with NODE_ENV=development set explicitly.

Merge-order note

#53 also rewrites package-lock.json. The two are independent and both are based on main @ e3864a7, but they will conflict textually. Whichever lands second should re-run its own npm update command rather than hand-merging the lockfile — a hand-merged lockfile is how you get a tree that installs but matches neither intent.

---

Note

Low Risk
Dev-toolchain lockfile patch with no runtime or published-package dependency changes; exposure is limited to local/CI builds.

Overview
Lockfile-only security bump: postcss 8.5.15 → 8.5.24 and transitive nanoid 3.3.12 → 3.3.16 (required by postcss’s updated range).

This addresses GHSA-r28c-9q8g-f849 (HIGH): path traversal when PostCSS auto-loads source maps from malicious sourceMappingURL comments in processed CSS. Both packages sit on the dev build path (vite / tsup), not in the published @wave-av/sdk artifact.

^{Reviewed by Cursor Bugbot for commit 8caf003. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

---

Summary by cubic

Updates dev postcss to 8.5.24 to patch GHSA-r28c-9q8g-f849 (source map path traversal). Lockfile-only; also bumps nanoid to 3.3.16 for postcss, affecting only the build chain via tsup and vite.

^{Written for commit b28037e. Summary will update on new commits.}

Summary by Sourcery

Update the development dependency lockfile to remove the vulnerable PostCSS version from the build toolchain.

Bug Fixes:

• Patch the vulnerable development-time PostCSS dependency to address GHSA-r28c-9q8g-f849.

Build:

• Update the lockfile’s PostCSS and transitive nanoid versions in the build toolchain.

---

CodeAnt-AI Description

Update PostCSS to address a source map path traversal vulnerability

What Changed

• Upgraded PostCSS from 8.5.15 to 8.5.24, including its required nanoid update
• Prevents the vulnerable handling of source map references that could disclose local .map files

Impact

✅ Reduced source map file disclosure risk
✅ Patched high-severity dependency vulnerability

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

---

PR Type

Bug fix

---

Description

• Update postcss to 8.5.24 to address GHSA-r28c-9q8g-f849 security vulnerability

• Update nanoid to 3.3.16 as dependency of postcss

---

Diagram Walkthrough

flowchart LR
  A["postcss 8.5.15"] --> B["postcss 8.5.24"]
  C["nanoid 3.3.12"] --> D["nanoid 3.3.16"]

Loading

File Walkthrough

	Relevant files

---

[changeset-bot]

⚠️ No Changeset found

Latest commit: b28037e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_bab7e0d2-a297-4932-bc35-827922b35bf9)

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: d4e49b1c-4836-4c91-af2a-b9b039aefc5b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/postcss-source-map-traversal

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/postcss-source-map-traversal

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

No reviewable files after applying ignore patterns.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	8caf003	Sep 06, 2026 · 20:06	20:07

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_caac7c43-1aec-4aa6-82ae-3082d85c6e85)

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR is confined to an owned, ignored lockfile and affects only development/build dependencies, but its explicit purpose is remediating a security advisory involving file disclosure. That security-sensitive scope warrants human review despite the limited runtime blast radius.

Not approved because:

• Credit balance exhausted. Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings. You can add or adjust custom eligibility rules. Learn more.}