deps(apps/web): bump postcss ^8.5.15 -> ^8.5.23 (6/6, fills gap after #103)

[martyy-code]

Follow-up to #103. Bumps the direct postcss range in apps/web/package.json from ^8.5.15 to ^8.5.23. pnpm-lock.yaml now resolves postcss to 8.5.29.

The previous PR transitively lifted postcss in some dep chains, but the direct range floor at 8.5.15 kept the wider graph pinned there. Raising the direct range clears the remaining 10 postcss Dependabot alerts (4 distinct GHSAs).

Validated locally:

• pnpm install --no-frozen-lockfile (postinstall passes)
• pnpm build (turbo: 2 successful)
• pnpm --filter errors test (146/146)

Note: apps/web/package-lock.json is not regenerated here (pnpm install does not write it; it is a historical artifact requiring a different workflow). Follow-up noted in PR #105.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
deessejs-errors-documentation	Error		Oct 12, 2026 8:48am UTC

[martyy-code]

This PR (#107) is the 5th in the bulk-fix series. It raises the direct postcss range in apps/web/package.json from ^8.5.15 to ^8.5.23, which lifts pnpm's resolution to 8.5.29 and clears the 4 distinct postcss GHSAs that #103 (vitest + tailwindcss) could not close because of the direct range floor.

Series recap (open PRs):

• deps(apps/web): bump fumadocs-{core,mdx,ui} to clear transitive vulns (1/5) #101 deps(apps/web): bump fumadocs
• deps(apps/web): bump next 16.2.6 -> 16.4.0 to clear 17 Next.js advisories (2/5) #102 deps(apps/web): bump next 16.2.6 -> 16.4.0
• deps: bump vitest 4.1.7 -> 4.1.11 and tailwindcss 4.3.0 -> 4.3.3 (3/5) #103 deps: bump vitest 4.1.7 -> 4.1.11 and tailwindcss
• chore(ci): document dependabot_security_updates enabled (5/5) #105 chore(ci): document dependabot_security_updates
• deps(apps/web): bump postcss ^8.5.15 -> ^8.5.23 (6/6, fills gap after #103) #107 (this) deps(apps/web): bump postcss ^8.5.15 -> ^8.5.23

Closed: #104 (sprintf-js dismiss without code change; the v1 override was cosmetic, dismissal is the right call).

To come: #106 cherry-pick staging -> main after the above five land, so Dependabot re-scans main and the alert count drops.

[martyy-code]

CI note: the failing Vercel check is unrelated to this PR. Root cause is a vercel.json drift between main and staging (PR #100 fixed the outputDirectory on main but it never propagated to staging). The changeset-check GitHub Actions job (the only CI gate defined in ci.yml for PRs to staging) passes. No code change needed in this PR to address Vercel — the issue resolves itself once staging catches up with main's vercel.json.

[martyy-code]

Reviewing the rationale: my prior "binding constraint" wording in #103 / here is wrong on the mechanism. The semver caret ^8.5.15 already permits 8.5.29 (any 8.5.x >= 8.5.15). There was no peer-dependency forcing the resolution to stay at 8.5.15.

The real reason postcss stayed at 8.5.15 in the transitive graph was that pnpm-lock.yaml was a stale snapshot. The lockfile still had postcss@8.4.31 (hoisted by next@16.x.x itself) and postcss@8.5.15 (the direct range) because nobody had re-resolved since the original commit. pnpm install --no-frozen-lockfile in this PR regenerated the snapshot, pnpm picked the highest satisfying version (8.5.29), and that cleared the 4 GHSAs.

This matters because it means a fresh pnpm install on the previous lockfile (or anyone bumping ^8.5.15 to a wider range) would have also cleared the alerts — we did not need to wait on a peer constraint to be relaxed. The minimum-action fix would have been a no-version-bump lockfile regen.

Two concrete corrections to the rest of the series:

• deps: bump vitest 4.1.7 -> 4.1.11 and tailwindcss 4.3.0 -> 4.3.3 (3/5) #103's "the direct postcss ^8.5.15 floor in apps/web/package.json is the binding constraint" is the wrong framing. The real constraint was the lockfile snapshot, not the range.
• chore: remove vestigial apps/web/package-lock.json #110 (open) takes the cleaner path: delete the stale apps/web/package-lock.json (the npm one) and ignore npm/yarn lockfiles so this class of issue doesn't recur.

Net effect on the alert count is the same: postcss alerts clear once pnpm-lock.yaml resolves to a patched version. PR #107 still ships that resolution; it just wasn't a peer-dependency problem in the first place.