Pin postcss to 8.5.23

[Copilot]

postcss resolved to a vulnerable 8.5.18 in the lockfile (github/vuln-mgmt#227844). It is not a direct dependency — it comes in transitively through vitest → vite, which requests ^8.5.16.

Changes

• package.json — added an overrides entry pinning postcss to 8.5.23, rather than promoting it to a direct dependency it isn't:

  "overrides": {
      "postcss": "8.5.23"
  }

• package-lock.json — regenerated; postcss now resolves to 8.5.23 (with its nanoid range moving to ^3.3.16), and vite's recorded requirement reflects the override.

Note that the override pins an exact version, so it will need to be bumped manually for future advisories. Loosening it to ^8.5.23 is an option if we'd rather let npm float it forward.

[Copilot]

Pull request overview

Pins transitive postcss to the security-fixed version.

Changes:

• Adds an npm override for postcss@8.5.23.
• Regenerates lockfile metadata and dependencies.

Show a summary per file

File	Description
package.json	Adds the exact-version override.
package-lock.json	Locks PostCSS and updated Nano ID metadata.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Balanced