chore(dev-deps): bump postcss from 8.5.14 to 8.5.18

[dependabot]

Bumps postcss from 8.5.14 to 8.5.18.

Release notes

Sourced from postcss's releases.

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

Changelog

Sourced from postcss's changelog.

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

Commits

• 4c0d194 Release 8.5.18 version
• 92b4e78 Update dependencies
• 95663d3 Limit where source map can be loaded for security reasons
• 74e25ae Release 8.5.17 version
• d1518af Fix Maximum call stack size exceeded error
• 2421312 Fix linter
• a50352c Fix CI
• 33948f0 Prevent prototype hijacking in fromJSON
• 2131909 Update dependencies
• 93440ab Fix non-closed \<div align="center"> in README (#2110)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cli-web-cli	Ready	Preview	Aug 2, 2026 2:54pm

[ci-lockfile-regen]

Dependabot Fix Assessment

Package: `postcss` `8.5.14` → `8.5.18` (patch)
Scope: devDependency (build tool)
Workspace: root

What changed upstream

• postcss 8.5.18 patches security vulnerabilities (GHSA-r28c-9q8g-f849 and others)
• No API or config changes between 8.5.14 and 8.5.18 — patch-only fix

Migration concerns checked

• Peer dependencies: OK
• Type changes: OK (patch bump, no API changes)
• Config files: OK
• Module format: OK
• React compatibility: OK
• Monorepo impact: OK (postcss is a transitive build dep; sub-packages use their own lockfile-pinned versions)

What broke

• Security Audit: Two critical vulnerabilities (CVSS 9.2) in tar 7.5.11 and 7.5.15 (GHSA-23hp-3jrh-7fpw) were newly registered in the OSV database. The existing pnpm override "tar@<7.5.11": "7.5.11" only prevented older versions from being used but left 7.5.11 and 7.5.15 (which are now also vulnerable) in place. These were pre-existing in the lockfile and not introduced by the postcss bump — but were newly caught by the audit.

What was fixed

• Updated pnpm.overrides in package.json from "tar@<7.5.11": "7.5.11" → "tar@<7.5.19": "7.5.19" to force all tar resolutions below 7.5.19 to use the patched version
• Updated the direct tar runtime dependency from ^7.5.15 → ^7.5.19 to keep the constraint and override in sync
• Ran pnpm install --no-frozen-lockfile — lockfile now resolves tar to 7.5.22 (latest), with no 7.5.11 or 7.5.15 remaining

Verification

• Build: ✅ (pnpm prepare succeeds)
• Lint: ✅ (0 errors)
• Unit tests: not run (no source code changed — only dependency versions)
• Web CLI tests: not run (no source code changed)

Notes for reviewer

• The critical tar vulnerability (GHSA-23hp-3jrh-7fpw, CVSS 9.2) was not introduced by this Dependabot PR — it was a pre-existing gap in the override floor that the security scanner newly picked up. The postcss bump itself is clean.
• The sub-package lockfiles (examples/web-cli/pnpm-lock.yaml, packages/react-web-cli/pnpm-lock.yaml) still have high-severity vulnerabilities (postcss 8.5.3, vite 6.2.4, etc.) but none are critical (CVSS >= 9.0), so the audit passes for those. Those should be addressed in separate Dependabot PRs for the sub-packages.