From e33eda3c38423b047f1c870ea7a452cf11b1741f Mon Sep 17 00:00:00 2001
From: Anso <dev@saelix.com>
Date: Fri, 24 Jul 2026 15:21:22 -0400
Subject: [PATCH] fix: pin postcss override to clear backend audit
 vulnerability (#1701)

vitest pulls in vite, which pulls in postcss@8.5.15, flagged high
severity for a source-map path traversal advisory. Pin postcss via
npm overrides (same pattern already used for brace-expansion) so the
fix is scoped to the vulnerable transitive dependency instead of
letting a broad npm audit fix churn unrelated packages.
---
 backend/package-lock.json | 14 +++++++-------
 backend/package.json      |  3 ++-
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/backend/package-lock.json b/backend/package-lock.json
index 37e09d66..756d7fa9 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -5081,9 +5081,9 @@
       "optional": true
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.16",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
       "dev": true,
       "funding": [
         {
@@ -5428,9 +5428,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.23",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
+      "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
       "dev": true,
       "funding": [
         {
@@ -5448,7 +5448,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
diff --git a/backend/package.json b/backend/package.json
index c6bd4607..467de07d 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -30,7 +30,8 @@
     "node": ">=26.0.0"
   },
   "overrides": {
-    "brace-expansion": "^5.0.7"
+    "brace-expansion": "^5.0.7",
+    "postcss": "^8.5.23"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",