fix: update postcss to 8.5.18 to resolve CVE-2026-45623 and GHSA-r28c-9q8g-f849

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

Bumped postcss override in package.json from 8.5.10 → 8.5.18 (transitive dependency). This resolves two high-severity path traversal / arbitrary file read vulnerabilities:

• Dependency: postcss bumped from 8.5.10 → 8.5.18 via overrides in package.json
• Advisory 1: GHSA-6g55-p6wh-862q (CVE-2026-45623 — arbitrary file read via attacker-controlled sourceMappingURL)
• Advisory 2: GHSA-r28c-9q8g-f849 (path traversal via sourceMappingURL leading to arbitrary .map file disclosure)
• Dependabot alert 1: https://github.com/warpdotdev/do-things/security/dependabot/27
• Dependabot alert 2: https://github.com/warpdotdev/do-things/security/dependabot/28
• Verification: npm audit no longer reports postcss vulnerabilities after the update

Highlight the risky code / where the dependency was used

postcss is a transitive dependency used by @tailwindcss/postcss and the Next.js build pipeline for CSS processing. The vulnerabilities are in postcss's source map handling — runtime CSS parsing, not application logic. Compatibility risk is low since this is a patch-level fix.

Special instructions for this PR

Run npm run build locally to confirm the Next.js build still works with postcss 8.5.18. The override in package.json ensures the patched version is used across all transitive dependents.

AFTER YOU MERGE

No post-merge steps required.

[dannyneira]

Dependency-only update looks safe based on diff scope and current PR status. Approving.