chore(deps): bump postcss to 8.5.23 to close path-traversal advisory

[chaliy]

What changed

Pins postcss to 8.5.23 in the site/ project via a pnpm.overrides entry, closing the open high-severity Dependabot alert on the default branch (path traversal in the previous source map). No site behavior changes — postcss is a build/transform dependency and this is a patch-level bump within 8.5.x.

Why

site/pnpm-lock.yaml resolved postcss@8.5.15 transitively (astro > vite > postcss), which is affected by GHSA-r28c-9q8g-f849 (high: PostCSS path traversal in previous source map, vulnerable <= 8.5.17). vite's transitive range keeps postcss below the 8.5.18 patch, so a pnpm override is required — matching the existing security-override pattern already in site/package.json (esbuild, undici, ws, yaml, …).

nanoid moves 3.3.12 → 3.3.16 as postcss's own transitive dependency; no other resolutions change.

Before / After

# Before (on main)
$ cd site && pnpm audit
┌─────────────────────┬──────────────────────────────────────────────┐
│ high                │ PostCSS: Path Traversal in Previous Source Map │
│ Package             │ postcss                                        │
│ Vulnerable versions │ <=8.5.17                                       │
│ Paths               │ .>astro>vite>postcss                           │
└─────────────────────┴──────────────────────────────────────────────┘
1 vulnerabilities found — Severity: 1 high

# After (this branch)
$ cd site && pnpm audit
No known vulnerabilities found
$ pnpm install --frozen-lockfile   # lockfile consistent
Done.

Note on the other pnpm audit finding

pnpm audit also reports a high for brace-expansion under crates/bashkit-js (dev/test tooling, ava > @vercel/nft > glob > minimatch). That one is not actionable and is intentionally left unchanged:

• The installed brace-expansion@2.1.2 already contains the bounded-expansion DoS fix (its expand() is max-bounded; the vulnerable 2.0.1 is not). The advisory's OSV range only credits 5.0.8, which is why the scanner still flags it.
• Forcing 5.x breaks minimatch@9's require('brace-expansion').default(...) interop (verified locally — TypeError: … .default is not a function), so a major override would break the test toolchain for no security benefit.

Risk

• Low
• postcss 8.5.15 → 8.5.23 is a patch-level bump on a build dependency; the site build is exercised by site.yml on this PR. No runtime/shipped-code change.

Checklist

• Tests added or updated — n/a (dependency security bump; site.yml build + pnpm audit cover it)
• Backward compatibility considered — no API/behavior change

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	52085bb	Commit Preview URL Branch Preview URL	Jul 27 2026, 09:34 AM