From d2dc74c0f953deeb36feecb7d87e9f78acdc793d Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 4 Aug 2026 15:03:17 +0200
Subject: [PATCH] =?UTF-8?q?=E2=AC=86=EF=B8=8F(dependencies)=20update=20pos?=
 =?UTF-8?q?tcss=20to=20v8.5.23=20[SECURITY]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL)
leads to Arbitrary .map File Disclosure
GHSA-r28c-9q8g-f849

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled
sourceMappingURL reads arbitrary .map files when from is unset
CVE-2026-69153 / GHSA-fxqj-rqcc-2cmp
---
 src/frontend/package.json |  2 +-
 src/frontend/yarn.lock    | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/src/frontend/package.json b/src/frontend/package.json
index a01bbab30..8ed6b83c1 100644
--- a/src/frontend/package.json
+++ b/src/frontend/package.json
@@ -40,7 +40,7 @@
     "dompurify": "3.4.12",
     "eslint": "10.7.0",
     "js-yaml": "5.2.2",
-    "postcss": "8.5.19",
+    "postcss": "8.5.23",
     "react": "19.2.7",
     "react-dom": "19.2.7",
     "serialize-javascript": "7.0.7",
diff --git a/src/frontend/yarn.lock b/src/frontend/yarn.lock
index a2244e65e..5dd7e7694 100644
--- a/src/frontend/yarn.lock
+++ b/src/frontend/yarn.lock
@@ -12175,10 +12175,10 @@ mylas@^2.1.9:
   resolved "https://registry.yarnpkg.com/mylas/-/mylas-2.1.13.tgz#1e23b37d58fdcc76e15d8a5ed23f9ae9fc0cbdf4"
   integrity sha512-+MrqnJRtxdF+xngFfUUkIMQrUUL0KsxbADUkn23Z/4ibGg192Q+z+CQyiYwvWTsYjJygmMR8+w3ZDa98Zh6ESg==
 
-nanoid@^3.3.12:
-  version "3.3.12"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.12.tgz#ab3d912e217a6d0a514f00a72a16543a28982c05"
-  integrity sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==
+nanoid@^3.3.16:
+  version "3.3.17"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.17.tgz#f1c3aa253c52547956a52c50bff754316f61037a"
+  integrity sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==
 
 nanoid@^5.1.3:
   version "5.1.6"
@@ -12730,12 +12730,12 @@ postcss-value-parser@^4.0.2, postcss-value-parser@^4.1.0, postcss-value-parser@^
   resolved "https://registry.yarnpkg.com/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz#723c09920836ba6d3e5af019f92bc0971c02e514"
   integrity sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==
 
-postcss@8.4.31, postcss@8.5.19, postcss@^8.5.17, postcss@^8.5.6:
-  version "8.5.19"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.19.tgz#45ad5cfde499408e20147348237551381a922037"
-  integrity sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==
+postcss@8.4.31, postcss@8.5.23, postcss@^8.5.17, postcss@^8.5.6:
+  version "8.5.23"
+  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.23.tgz#3493550116f478487298301d2c2e8dc5a56e6594"
+  integrity sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==
   dependencies:
-    nanoid "^3.3.12"
+    nanoid "^3.3.16"
     picocolors "^1.1.1"
     source-map-js "^1.2.1"