chore(deps): move Next PostCSS path to 8.5.10 or newer #67

Security follow-up

Production audit after the July 2026 remediation still reports one moderate advisory: GHSA-qx2v-qp2m-jg93 / CVE-2026-41305 (PostCSS, vulnerable below 8.5.10).

Current paths:

• apps/grok-spiral > next 15.5.18 > postcss 8.4.49
• apps/web > next 15.5.18 > postcss 8.4.49
• apps/web > next-intl 4.13.2 > next 15.5.18 > postcss 8.4.49

Applicability and current mitigation

The issue requires attacker-controlled CSS to be parsed/stringified and embedded into an HTML style context. ground.codes does not accept, store, or render user-supplied CSS. PostCSS is used by the trusted Next build pipeline. The current remediation removes all high and critical production advisories; this moderate is tracked rather than waived silently.

Completion criteria

• Move every production PostCSS path to 8.5.10 or newer through a compatible Next release or reviewed override.
• Run frozen install, production audit, Web/Grok unit/type/build checks, and Web browser smoke.
• Confirm production audit no longer reports GHSA-qx2v-qp2m-jg93.