security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-6g55-p6wh-862q	postcss	None	8.5.6	8.5.23		confirmed

Not Included

• Deferred by batch limit: 68 advisories. They will be considered by future runs.
• Other deferred scanner findings: 1.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	tar	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Dependency-only security patch with no runtime or auth logic changes; main follow-up is confirming bun install and CSS builds still pass.

Overview
This PR remediates GHSA-6g55-p6wh-862q by raising the direct postcss devDependency from 8.5.6 to ^8.5.23 in package.json and refreshing bun.lock.

The lockfile now resolves the top-level postcss@8.5.23 (with an updated nanoid transitive) and aligns with Next’s pinned postcss 8.5.23 dependency. No application or config source files change—only the CSS build toolchain versions used by Tailwind/Next.

^{Reviewed by Cursor Bugbot for commit fc16ec5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Sep 23, 2026 3:20am UTC