diff --git a/.changeset/fix-dep-postcss-direct.md b/.changeset/fix-dep-postcss-direct.md
new file mode 100644
index 0000000..ba79032
--- /dev/null
+++ b/.changeset/fix-dep-postcss-direct.md
@@ -0,0 +1,30 @@
+---
+'@deessejs/errors': patch
+---
+
+deps(apps/web): bump direct `postcss` from `^8.5.15` to `^8.5.23` to clear the remaining 10 postcss Dependabot alerts.
+
+## Mechanism
+
+The caret range `^8.5.15` was not the binding constraint. Caret semver already permits any `8.5.x >= 8.5.15`, including the patched `8.5.29`; no peer dependency was forcing the resolution to a vulnerable version. The actual reason `pnpm-lock.yaml` still pinned vulnerable postcss versions was that the lockfile was a stale snapshot from the original commit, and pnpm re-uses locked versions until the lockfile is regenerated.
+
+`pnpm install --no-frozen-lockfile` in this PR re-resolved the graph and pnpm picked the highest version satisfying every constraint — `8.5.29`. The lockfile regen alone would have closed the alerts. This PR additionally raises the direct range to `^8.5.23` so the manifest is explicit about the floor we want, and to keep the lockfile in step if a future contributor runs `pnpm install --frozen-lockfile`.
+
+## Advisories cleared (4 distinct GHSAs, 10 alerts)
+
+- GHSA-6g55-p6wh-862q (patched in 8.5.12)
+- GHSA-fxqj-rqcc-2cmp (patched in 8.5.23)
+- GHSA-qx2v-qp2m-jg93 (patched in 8.5.10)
+- GHSA-r28c-9q8g-f849 (patched in 8.5.18)
+
+The transitive `postcss@8.4.31` hoisted by `next@16.x.x` is below 8.5.10 and not in the Dependabot view; it is not reported as an alert.
+
+## Scope
+
+This PR touches `pnpm-lock.yaml` and `apps/web/package.json` only. The companion cleanup of the vestigial `apps/web/package-lock.json` (an npm lockfile that no CI step reads, and which is a permanent source of duplicate Dependabot noise) lives in PR #110; that removal prevents the same class of drift from recurring in future cleanup rounds.
+
+## Validation
+
+- `pnpm install --no-frozen-lockfile` (postinstall passes)
+- `pnpm build` (turbo: 2 successful)
+- `pnpm --filter errors test` (146/146)
diff --git a/apps/web/package.json b/apps/web/package.json
index ad8bb2f..5443566 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -36,7 +36,7 @@
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.5",
     "happy-dom": "^20.11.2",
-    "postcss": "^8.5.15",
+    "postcss": "^8.5.23",
     "tailwindcss": "^4.3.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f6e4245..638a408 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -89,8 +89,8 @@ importers:
         specifier: ^20.11.2
         version: 20.14.5
       postcss:
-        specifier: ^8.5.15
-        version: 8.5.15
+        specifier: ^8.5.23
+        version: 8.5.29
       tailwindcss:
         specifier: ^4.3.0
         version: 4.3.0
@@ -2552,6 +2552,11 @@ packages:
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
+  nanoid@3.3.20:
+    resolution: {integrity: sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
   next-themes@0.4.6:
     resolution: {integrity: sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA==}
     peerDependencies:
@@ -2684,8 +2689,8 @@ packages:
     resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
     engines: {node: ^10 || ^12 || >=14}
 
-  postcss@8.5.15:
-    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
+  postcss@8.5.29:
+    resolution: {integrity: sha512-49cGhUbXj8Qenv0iTMxA1cFBzxXoctpC9Ujd77t1WcbJIr6nF/eI7g/8MgxrYldFRuAXvja7xQRwavoW7kgrxQ==}
     engines: {node: ^10 || ^12 || >=14}
 
   prettier@2.8.8:
@@ -2876,6 +2881,10 @@ packages:
     resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
     engines: {node: '>=0.10.0'}
 
+  source-map-js@1.2.2:
+    resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
+    engines: {node: '>=0.10.0'}
+
   source-map@0.7.6:
     resolution: {integrity: sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==}
     engines: {node: '>= 12'}
@@ -4373,7 +4382,7 @@ snapshots:
       '@alloc/quick-lru': 5.2.0
       '@tailwindcss/node': 4.3.0
       '@tailwindcss/oxide': 4.3.0
-      postcss: 8.5.15
+      postcss: 8.5.29
       tailwindcss: 4.3.0
 
   '@turbo/darwin-64@2.9.15':
@@ -5695,6 +5704,8 @@ snapshots:
 
   nanoid@3.3.12: {}
 
+  nanoid@3.3.20: {}
+
   next-themes@0.4.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
     dependencies:
       react: 19.2.6
@@ -5842,11 +5853,11 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  postcss@8.5.15:
+  postcss@8.5.29:
     dependencies:
-      nanoid: 3.3.12
+      nanoid: 3.3.20
       picocolors: 1.1.1
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   prettier@2.8.8: {}
 
@@ -6117,6 +6128,8 @@ snapshots:
 
   source-map-js@1.2.1: {}
 
+  source-map-js@1.2.2: {}
+
   source-map@0.7.6: {}
 
   space-separated-tokens@2.0.2: {}
@@ -6301,7 +6314,7 @@ snapshots:
     dependencies:
       lightningcss: 1.32.0
       picomatch: 4.0.4
-      postcss: 8.5.15
+      postcss: 8.5.29
       rolldown: 1.0.2
       tinyglobby: 0.2.16
     optionalDependencies: