# Continuity ledger (per-branch)

## Human intent (must not be overwritten)

- Resolve Dependabot alert https://github.com/giselles-ai/giselle/security/dependabot/176
  (GHSA-qx2v-qp2m-jg93 / CVE-2026-41305: postcss XSS via unescaped `</style>`
  in stringify output, fixed in 8.5.10).

## Goal (incl. success criteria)

- All postcss copies in the lockfile sit on 8.5.10+; alert closes.

## Constraints/Assumptions

- Three vulnerable copies in the lockfile pre-fix: 8.4.31, 8.5.5, 8.5.6.
  - 8.4.31 — pulled by `next 16.2.3`
  - 8.5.5 — direct catalog dep (used by `apps/studio.giselles.ai`,
    `apps/ui.giselles.ai`)
  - 8.5.6 — pulled by `vite`, `vitest`, `@tailwindcss/postcss`

## Key decisions

- Two coordinated changes:
  1. `pnpm-workspace.yaml` catalog: `postcss: 8.5.5` → `8.5.12` (covers the
     direct consumers; both reference `"postcss": "catalog:"`).
  2. `package.json` pnpm override: `"postcss@<8.5.10": "8.5.12"` for transitive
     pulls (next, vite, vitest, tailwind), matching the existing scoped
     override pattern (e.g. `undici@>=7.0.0 <7.24.0`).
- Picked 8.5.12 (latest 8.5.x at time of fix); minor patches above 8.5.10 are
  bug fixes only.

## State

- Lockfile collapsed all three previous postcss versions to 8.5.12.
- `pnpm format / build-sdk / check-types / test` all green.

## Done

- pnpm-workspace.yaml: postcss catalog 8.5.5 → 8.5.12.
- package.json: added `"postcss@<8.5.10": "8.5.12"` override.
- pnpm-lock.yaml: regenerated.

## Now

- Commit, push, open PR.

## Next

- Watch CI (License Compliance auto-updates `docs/packages-license.md`).

## Open questions (UNCONFIRMED if needed)

- None.

## Working set (files/ids/commands)

- pnpm-workspace.yaml
- package.json
- pnpm-lock.yaml
- Alert: https://github.com/giselles-ai/giselle/security/dependabot/176
- Advisory: https://github.com/advisories/GHSA-qx2v-qp2m-jg93
