[bgentry]

Override postcss-selector-parser only under @tailwindcss/typography to 6.1.5, the maintained 6.x security backport for GHSA-rj75-hqrm-r3gf. Typography currently pins 6.0.10; this keeps the parser major and all other package versions unchanged.

The backport replaces quadratic selector-index scans with Set lookups. The aggregated advisory still reports all versions below 7.1.6 as vulnerable, while the upstream advisory and merged backport identify 6.1.5 as fixed, so npm audit currently retains a stale finding.

[bgentry]

@brandur fast tracking this one to clear the security alert.

[bgentry]

🤖 Codex review: The dependency security gate is clear, and exact-head local compatibility checks pass. Comment-only because this PR is authored by the authenticated account. CI status is recorded below.

Upgrade

• postcss-selector-parser: 6.0.10 → 6.1.5, scoped only to @tailwindcss/typography through an exact override.
• Reviewed head: 9a9480bd02dc7debf77b2b98efdea1ebebb962bd.
• Base: 74822e08092768c1b33c099c62011fae39d28525.
• The complete PR changes only the scoped override and one canonical npm lock entry, including MIT license metadata. No other versions, graph edges, hooks, bins, native packages, registry sources, or same-version integrity values change.

Security review

• Independent read-only review compares actual 6.0.10 / 6.1.5 registry tarballs, compiled runtime changes, upstream source commits, the signed backport/release, and Typography's parser API usage. SHA-512 values match registry and lock identities; npm ECDSA signatures verify. The publisher changes between established upstream maintainers; repository, ownership, license, runtime dependencies, and CommonJS API remain consistent.
• The runtime retains cssesc and util-deprecate only. No new installation execution path, binary/WASM payload, network request, filesystem/environment/credential access, process execution, dynamic evaluation, or obfuscation was found. Parser build provenance is not advertised and is not assumed.
• The upstream advisory recognizes 6.1.5 and 7.1.6 as patched. Inspected the actual merged 6.x backport: all three quadratic index scans use Set membership; bounded nesting is also present. This avoids forcing Typography onto parser major 7 while its current release still pins 6.0.10.
• Reused the exact signed artifact/source-pair evidence, then independently bound it to this PR's current base, head, scoped override, dependency graph, and integrity values. No security delta or blocking finding remains.

Compatibility verification

Completed in isolation using Node 24.21.0 / npm 11.19.0:

• npm ci --no-audit --no-fund — passed normally from the lockfile with the repository's release-age configuration unchanged.
• npm ls postcss-selector-parser @tailwindcss/typography — unchanged Typography resolves the overridden 6.1.5 artifact.
• Installed-parser regression checks — 60,000 flat class selectors parse and roundtrip correctly; excessive nesting throws a regular guarded error.
• Comparative published-plugin harness — 14 selector cases and eight complete Typography configurations produce byte-identical output with the old parser and the backport.
• CI=true npm run test:once — 35 files / 243 tests passed.
• CI=true npm run lint — passed.
• CI=true npm run build — TypeScript and production build passed; generated CSS is byte-identical to the same base with the original parser.
• CI=true STORYBOOK_DISABLE_TELEMETRY=1 npm run build-storybook -- --disable-telemetry — passed.

CI and merge status

All required GitHub checks pass on this head. CI passes the full Go/PostgreSQL matrix, Go lint, sqlc verification, frontend checks, and release builds. Both architecture builds and manifest jobs pass for open-source Docker and Pro Docker; CodeQL checks also pass.

Residual risk / cleanup

• npm audit --json still flags this backport because the aggregated advisory lists all <7.1.6 versions, omitting the upstream-recognized 6.1.5 fix. The finding is documented, not suppressed; the actual patch, upstream advisory, signed release, and compatibility evidence support the security-clear decision. This PR separately retains the unchanged shell-quote finding addressed by #708.
• This scoped override is temporary. On the next Typography upgrade, remove it if Typography's own dependency resolves to a patched parser without it, then inspect the lockfile and rerun affected checks. Do not retain the pin indefinitely or force a major upgrade solely to clear stale advisory metadata.
• Static review of generated package code is not a reproducible-build proof; no parser SLSA build attestation is available.
• This comment records the security and compatibility decision on the reviewed head; no merge or protection override is performed in this review pass.

[bgentry]

🤖 Codex review: The dependency security gate is clear, and exact-head local compatibility checks pass. Comment-only because this PR is authored by the authenticated account. CI status is recorded below.

Upgrade

• postcss-selector-parser: 6.0.10 → 6.1.5, scoped only to @tailwindcss/typography through an exact override.
• Reviewed head: 54a7cb03e14e9294f1042892f34832c5ee2dec9e.
• Base: e440fa11b95c86583e7683248962c4bbaf24bcc5.
• The complete PR changes only the scoped override and one canonical npm lock entry, including MIT license metadata. No other versions, graph edges, hooks, bins, native packages, registry sources, or same-version integrity values change.

Security review

• Independent read-only review compares actual 6.0.10 / 6.1.5 registry tarballs, compiled runtime changes, upstream source commits, the signed backport/release, and Typography's parser API usage. SHA-512 values match registry and lock identities; npm ECDSA signatures verify. The publisher changes between established upstream maintainers; repository, ownership, license, runtime dependencies, and CommonJS API remain consistent.
• The runtime retains cssesc and util-deprecate only. No new installation execution path, binary/WASM payload, network request, filesystem/environment/credential access, process execution, dynamic evaluation, or obfuscation was found. Parser build provenance is not advertised and is not assumed.
• The upstream advisory recognizes 6.1.5 and 7.1.6 as patched. Inspected the actual merged 6.x backport: all three quadratic index scans use Set membership; bounded nesting is also present. This avoids forcing Typography onto parser major 7 while its current release still pins 6.0.10.
• Reused the exact signed artifact/source-pair evidence, then independently bound it to this current base, head, scoped override, dependency graph, and integrity values. The new head normally merges the current base after #708, preserving both reviewed overrides. Against that base, only the original parser delta remains; against the previous head, only the exact reviewed shell-quote delta is inherited. Independent manifest and lock comparisons find no additional artifact, graph, source, lifecycle, or execution-context change. No blocking finding remains.

Compatibility verification

Reran tree-specific checks on this combined head in isolation using Node 24.21.0 / npm 11.19.0:

• npm ci --no-audit --no-fund — passed normally from the lockfile with the repository's release-age configuration unchanged.
• npm ls shell-quote postcss-selector-parser concurrently @tailwindcss/typography — unchanged Typography resolves parser 6.1.5; concurrently resolves shell-quote 1.11.0. The shell-quote comment/line-terminator regression harness and controlled concurrently smoke test also pass.
• Installed-parser regression checks — 60,000 flat class selectors parse and roundtrip correctly; excessive nesting throws a regular guarded error.
• Reused comparative published-plugin harness evidence — 14 selector cases and eight complete Typography configurations produce byte-identical output with the old parser and the backport. Those exact plugin/parser artifacts and harness inputs are unchanged.
• CI=true npm run test:once — 35 files / 243 tests passed.
• CI=true npm run lint — passed.
• CI=true npm run build — TypeScript and production build passed; generated CSS is byte-identical to the same base with the original parser.
• CI=true STORYBOOK_DISABLE_TELEMETRY=1 npm run build-storybook -- --disable-telemetry — passed.

CI and merge status

All required GitHub checks pass on this head except the open-source Docker manifest check, which still reports in_progress despite every job step (including manifest publishing, cleanup, and Complete job) reporting success and its workflow reporting completed/success. There is no failed step. This status discrepancy is recorded for the explicitly authorized administrator override. CI passes the full Go/PostgreSQL matrix, Go lint, sqlc verification, frontend checks, and release builds. Both architecture builds pass for open-source Docker and Pro Docker, and every manifest step succeeds. The Pro manifest check and CodeQL checks pass; the open-source manifest check has the status discrepancy described above.

Residual risk / cleanup

• npm audit --json still flags this backport because the aggregated advisory lists all <7.1.6 versions, omitting the upstream-recognized 6.1.5 fix. The finding is documented, not suppressed; the actual patch, upstream advisory, signed release, and compatibility evidence support the security-clear decision. On this combined head, audit reports zero critical/high findings and two moderate records for the parser/typography chain from this stale range; the shell-quote finding is gone after #708.
• This scoped override is temporary. On the next Typography upgrade, remove it if Typography's own dependency resolves to a patched parser without it, then inspect the lockfile and rerun affected checks. Do not retain the pin indefinitely or force a major upgrade solely to clear stale advisory metadata.
• Static review of generated package code is not a reproducible-build proof; no parser SLSA build attestation is available.
• Security and compatibility gates are clear for this reviewed head, with no blocking finding. GitHub self-approval is unavailable for the same-account PR author; this comment records the full decision before the explicitly authorized merge.