fix(deps): bump postcss to 8.5.24 (GHSA-r28c-9q8g-f849, unreported by dependabot)

[yakimoto]

Clears a HIGH that Dependabot is not reporting. Lockfile only — 7 lines.

postcss  8.5.15 → 8.5.24    (dev scope, via tsup + vite)
nanoid   3.3.12 → 3.3.16    (required by postcss's new range ^3.3.16)

The advisory

GHSA-r28c-9q8g-f849 — PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure. HIGH, range <= 8.5.17, first patched 8.5.18, published 2026-07-24.

It is in the GitHub Advisory Database — I read it straight from the API:

$ gh api graphql -f query='{securityVulnerabilities(ecosystem:NPM, package:"postcss", …)}'
GHSA-r28c-9q8g-f849 HIGH range=<= 8.5.17 fix=8.5.18 pub=2026-07-24T16:24:55Z

But this repo's Dependabot alert list has only brace-expansion and esbuild. The push that created this branch said so itself:

remote: GitHub found 2 vulnerabilities on wave-av/sdk's default branch (1 high, 1 low).

Two, not three. So this one was reachable only by running the audit — which is how I found it, while measuring the baseline for #53.

I checked whether the silence just meant "no postcss here." It doesn't. Reading origin/main refs rather than working trees:

repo	postcss on origin/main	Dependabot alert
sdk	8.5.15	none
sdks (sdk-typescript/pnpm-lock.yaml)	8.5.15	none
mcp-server	absent	none (correct)
adk	absent	none (correct)

Both repos that actually carry a vulnerable postcss have no alert; the two clean repos correctly have none. That's a detection gap, not absence — filed separately as wave-av/claude-workstation#564. sdks needs the same bump and does not have it yet.

Scope

Dev-only. postcss is a peer of the build toolchain and never enters the published dependency graph of @wave-av/sdk:

$ npm why postcss
postcss@8.5.15 dev
  peerOptional postcss@">=8.0.9" from postcss-load-config@6.0.1 → tsup@8.5.1
  peerOptional postcss@"^8.4.12" from tsup@8.5.1
  postcss@"^8.5.15" from vite@8.0.16

The exploit path is a malicious sourceMappingURL comment in CSS the toolchain processes. This SDK ships no CSS, so the practical exposure is low — but it's a HIGH in the build path, the fix is seven lines, and there's no reason to carry it.

Landing on 8.5.24 (current latest) rather than the minimum 8.5.18, since npm update resolves within the declared range and the intermediate releases are patch-level.

Verification

CI can't run — Actions are refusing every job org-wide on an account-level billing lock (plan=free, locked=yes, re-confirmed live today). All local, Node 22.14.0:

npm run build       → success        ← the one that matters; postcss is in the build path
npm run lint        → clean (--max-warnings 0)
npm run type-check  → clean
npm test            → 90 tests / 2 files, 0 failed

Advisory delta, dev scope included, against main @ e3864a7:

	total	high	low
main	3	2	1
this PR	2	1	1

The remaining high is brace-expansion, which #53 clears. With both landed the repo is down to one dev-only esbuild low.

Measurement caveat: this workstation exports NODE_ENV=production, which makes npm audit inherit omit=dev and hide dev-scope entries entirely — including both of these. Every figure above was taken with NODE_ENV=development set explicitly.

Merge-order note

#53 also rewrites package-lock.json. The two are independent and both are based on main @ e3864a7, but they will conflict textually. Whichever lands second should re-run its own npm update command rather than hand-merging the lockfile — a hand-merged lockfile is how you get a tree that installs but matches neither intent.

---

Note

Low Risk
Dev-only lockfile bumps with no runtime or published-package graph changes; practical exploit risk is low for an SDK that does not ship CSS through PostCSS.

Overview
Lockfile-only dependency refresh to address GHSA-r28c-9q8g-f849 (HIGH: path traversal / arbitrary .map disclosure via PostCSS source-map auto-loading). Dependabot did not surface this alert for this repo.

Resolved versions: postcss 8.5.15 → 8.5.24 and nanoid 3.3.12 → 3.3.16 (pulled in by PostCSS’s updated nanoid range). Both sit in the dev graph via tsup / vite / postcss-load-config and are not part of the published @wave-av/sdk runtime bundle.

^{Reviewed by Cursor Bugbot for commit b28037e. Configure here.}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

---

Summary by cubic

Updates dev postcss to 8.5.24 to patch GHSA-r28c-9q8g-f849 (source map path traversal). Lockfile-only; also bumps nanoid to 3.3.16 for postcss, affecting only the build chain via tsup and vite.

^{Written for commit b28037e. Summary will update on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: b28037e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_bab7e0d2-a297-4932-bc35-827922b35bf9)

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9658f978-03e0-4710-876c-908b44fe025a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/postcss-source-map-traversal

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/postcss-source-map-traversal

---

_{Comment @coderabbitai help to get the list of available commands.}