Track upstream fix for Next bundled PostCSS advisory

[baixiangcpp]

Context

After PR #6, production dependency audit is gated in CI with:

npm run check:audit:prod-high

That gate passes and there are currently 0 high and 0 critical production advisories.

The remaining production audit finding is a moderate advisory inherited from Next.js bundling PostCSS:

• Advisory: GHSA-qx2v-qp2m-jg93
• Package: postcss
• Vulnerable range: <8.5.10
• Installed path: node_modules/next/node_modules/postcss
• Current bundled version from next@16.2.9: postcss@8.4.31
• npm audit relationship: next -> postcss
• Current npm audit metadata: 2 moderate, 0 high, 0 critical production vulnerabilities

Why this was not fixed in PR #6

As of 2026-06-18, the latest stable next version available to this project is 16.2.9, and it still depends on postcss@8.4.31.

npm audit fix --force suggests installing next@9.3.3, which is a major breaking downgrade and is not an acceptable remediation path for this app.

Risk Boundary

The advisory is for PostCSS stringification of CSS containing an unescaped </style> sequence. In this app, the vulnerable copy is bundled under Next internals rather than a direct application dependency. We should keep it visible and tracked, but avoid forcing an unsafe framework downgrade.

Remediation Plan

• Monitor Next.js releases for a stable version that updates the bundled PostCSS dependency to >=8.5.10.
• When available, upgrade next and @next/bundle-analyzer together.
• Re-run dependency installation with the project-supported toolchain: Node 20.x and npm 10.x.
• Re-run audit and the full CI-equivalent validation suite.
• Remove this issue only after npm audit --omit=dev --json reports 0 moderate/high/critical production vulnerabilities, or after a documented upstream/non-applicable determination.

Acceptance Criteria

• npm audit --omit=dev --json no longer reports next -> postcss.
• npm run check:audit:prod-high passes.
• npm run lint passes.
• npm test passes.
• npm run validate passes.
• npm run build:app passes.
• npm run build:post passes.
• npm run test:e2e:smoke passes.

References

• Advisory: GHSA-qx2v-qp2m-jg93
• Follow-up from PR Harden production dependency audit #6: Harden production dependency audit #6

[baixiangcpp]

Follow-up audit handoff: Next bundled PostCSS advisory

Reviewed on 2026-06-20 after the audit-hardening work in PR #15.

Current assessment

Keep this issue open. The current risk boundary is still correct: the remaining advisory is a moderate PostCSS advisory inherited through Next's bundled dependency, not through a direct application postcss dependency. The upstream advisory is GHSA-qx2v-qp2m-jg93, patched in postcss@8.5.10:

• GHSA-qx2v-qp2m-jg93
• GHSA-qx2v-qp2m-jg93

Do not apply npm audit fix --force if it suggests a framework downgrade. That path is outside the acceptable remediation boundary for this app.

Agent workflow for next remediation attempt

Use a dedicated branch, for example:

git checkout main
git pull --ff-only
git checkout -b chore/track-next-postcss-advisory

Then gather the current dependency evidence:

node --version
npm --version
npm view next version
npm view next@latest version
npm view next@latest dependencies --json
npm audit --omit=dev --json > output/reports/npm-audit-prod.json

Install with the project-supported toolchain and inspect the bundled PostCSS version:

npm ci
node -p "require('./node_modules/next/package.json').version"
node -p "require('./node_modules/next/node_modules/postcss/package.json').version"
npm audit --omit=dev

If the latest stable next release bundles postcss >= 8.5.10, open a small upgrade PR:

npm install next@<stable-version> @next/bundle-analyzer@<same-version> --package-lock-only
npm ci
node -p "require('./node_modules/next/node_modules/postcss/package.json').version"

Run the full release-sensitive validation set:

npm run check:audit:prod-high
npm run lint
npm run test
npm run test:coverage
npm run validate
npm run build
npm run test:e2e:smoke
npm run test:e2e:pwa

Optional canary probe

A canary or preview Next version may be checked only in a throwaway probe branch. Do not merge canary into main unless there is an explicit project decision to accept preview framework risk.

Suggested probe branch:

git checkout -b probe/next-postcss-canary
npm install next@canary @next/bundle-analyzer@canary --package-lock-only
npm ci
node -p "require('./node_modules/next/node_modules/postcss/package.json').version"
npm run validate
npm run build

If canary fixes the advisory but stable does not, add a short comment here with:

• Next canary version tested.
• Bundled PostCSS version.
• Whether validate and build pass.
• Why the result is only evidence for monitoring, not a merge candidate.

Acceptance criteria for closing this issue

Close this issue only when all of the following are true:

• node -p "require('./node_modules/next/node_modules/postcss/package.json').version" reports 8.5.10 or newer after npm ci.
• npm audit --omit=dev --json no longer reports the next -> postcss advisory path, or the advisory has an upstream-documented non-applicable determination.
• npm run check:audit:prod-high passes.
• npm run lint passes.
• npm run test passes.
• npm run test:coverage passes.
• npm run validate passes.
• npm run build passes.
• npm run test:e2e:smoke passes.
• npm run test:e2e:pwa passes.

Non-goals

• Do not downgrade Next.
• Do not loosen audit gates.
• Do not suppress the advisory without evidence.
• Do not add a server-side workaround; this app's privacy model remains static export and browser-local processing.

[baixiangcpp]

Dependency check on 2026-06-20: the stable upstream state has not changed.

• next@latest: 16.2.9
• next@16.2.9 bundled postcss dependency: 8.4.31
• @next/bundle-analyzer@latest: 16.2.9

The GHSA-qx2v-qp2m-jg93 tracking issue should remain open until a stable Next release bundles postcss >=8.5.10 or we document a separate upstream/non-applicable determination.

[baixiangcpp]

Canary probe on 2026-06-20:

Stable remains unchanged and should stay on the existing tracking path:

• next@latest: 16.2.9
• next@16.2.9 bundled postcss: 8.4.31
• @next/bundle-analyzer@latest: 16.2.9

Canary evidence in an isolated worktree based on origin/main@0dcf114:

• next@canary resolved to 16.3.0-canary.59
• @next/bundle-analyzer@canary resolved to 16.3.0-canary.59
• bundled next/node_modules/postcss resolved to 8.5.10
• npm ci passed under Node 20.19.0 / npm 10.9.4 with engine strict enabled
• npm run validate passed
• npm run build:app passed
• npm run build:post passed

This is useful upstream evidence that the PostCSS bump has landed in canary, but it is not a merge candidate for main. Keep this issue open until the same PostCSS >=8.5.10 dependency is available in a stable Next release and the full CI-equivalent suite passes on that stable release.

[baixiangcpp]

Dependency check on 2026-06-27: stable upstream state has not changed.\n\n- next@latest: 16.2.9\n- @next/bundle-analyzer@latest: 16.2.9\n- next@latest bundled postcss dependency: 8.4.31\n- locally installed next/postcss: 16.2.9 / 8.4.31\n\nThis still does not meet the issue closing criteria (postcss >= 8.5.10 from a stable Next release), so no remediation PR was opened.

[baixiangcpp]

PR #300 landed docs/security/next-postcss-advisory-runbook.md and guard coverage for the #7 stable-remediation criteria.

Stable check on 2026-06-27 still does not meet the close criteria:

• next@latest: 16.2.9
• @next/bundle-analyzer@latest: 16.2.9
• next@latest bundled postcss: 8.4.31
• Required for close: stable Next bundling postcss >= 8.5.10, or an upstream non-applicable determination.

No remediation PR was opened because the stable upstream state has not changed and npm audit fix --force remains outside the acceptable path. Keep this issue open.

[baixiangcpp]

Dependency check on 2026-06-29: stable upstream state still does not meet the close criteria.

Evidence gathered:

• Local project dependency: next@16.2.9
• Local bundled Next PostCSS: 8.4.31
• npm view next version: 16.2.9
• npm view @next/bundle-analyzer version: 16.2.9
• npm view next@latest dependencies --json: bundled postcss remains 8.4.31
• npm audit --omit=dev --json: still reports 2 moderate production findings on the next -> postcss path for GHSA-qx2v-qp2m-jg93
• npm audit still reports a force-fix path that downgrades Next to 9.3.3, which remains outside the accepted remediation boundary.

Environment note: this local shell currently has Node v24.13.0 and npm 11.6.2, while the project engines require Node 20.x and npm 10.x. I used this run only for upstream/package evidence and did not run the full close-validation suite or open an upgrade PR.

Keeping this issue open until a stable Next release bundles postcss >= 8.5.10, or an upstream non-applicable determination is documented.

[baixiangcpp]

Upstream dependency refresh on 2026-07-16: the stable release still does not meet #7's close criteria.

Evidence:

• Project dependency: next@16.2.9
• Current stable next@latest: 16.2.10
• Current stable @next/bundle-analyzer@latest: 16.2.10
• next@16.2.10 still declares bundled postcss@8.4.31
• Required remediation remains stable Next bundling postcss >= 8.5.10
• npm audit --json still reports GHSA-qx2v-qp2m-jg93 through the next -> postcss path and still offers only the unacceptable forced downgrade path

The local shell is Node v24.13.0 / npm 11.6.2, outside the repository's Node 20/npm 10 support contract, so this refresh is dependency evidence only; no framework upgrade or close-validation suite was attempted. Keep #7 open. Do not downgrade Next or suppress the advisory.