chore: upgrade postcss-selector-parser to ^6.1.4 to address CVE-2026-9358

[claude]

Fixes SOU-2117

Summary

Moves every postcss-selector-parser instance in the dependency graph to 6.1.4, at or above the 6.1.3 patched floor.

Two distinct requesters were pulling vulnerable versions:

• tailwindcss@3.4.17 (^6.1.2) and postcss-nested@6.2.0 (^6.1.1) resolved to 6.1.2. Those ranges already admitted the patched release, so a yarn up -R postcss-selector-parser lockfile refresh was sufficient.
• @tailwindcss/typography requests postcss-selector-parser at the exact version 6.0.10. Every published release of that plugin up to and including the current 0.5.20 still pins 6.0.10, so no top-level upgrade can relax it. This required the narrowest available fallback: a qualified resolutions entry keyed to the existing source range.

"postcss-selector-parser@npm:6.0.10": "^6.1.3"

Advisory addressed

• CVE-2026-9358 — postcss-selector-parser allows denial of service through uncontrolled AST recursion in toString (src/selectors/container.js). Patched in 6.1.3 / 7.1.1.

Verification

• yarn why postcss-selector-parser reports 6.1.4 for all five requester paths — no vulnerable version remains in the dependency graph.
• yarn install --immutable succeeds.
• yarn test passes: 1439 web tests across 139 files, plus the queryLanguage, shared, and backend suites.
• yarn build succeeds for all workspaces, including the Next.js production build. This exercises the affected code path directly, since Tailwind, postcss-nested, and the typography plugin all run postcss-selector-parser during CSS compilation.

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only security bump with no application logic changes; residual risk is limited to CSS build-time behavior in Tailwind/PostCSS plugins.

Overview
Addresses CVE-2026-9358 by ensuring every postcss-selector-parser copy in the lockfile resolves to 6.1.4 (patched at 6.1.3+).

Most consumers (tailwindcss, postcss-nested) already allowed newer 6.x; the lockfile refresh bumps them off 6.1.2. @tailwindcss/typography still pins 6.0.10, so the PR adds a Yarn resolutions override (postcss-selector-parser@npm:6.0.10 → ^6.1.3) to force the patched line without changing app code. The unreleased changelog records the upgrade.

^{Reviewed by Cursor Bugbot for commit 46e0772. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Upgrades every postcss-selector-parser instance in the dependency graph to 6.1.4, closing CVE-2026-9358 (denial of service via uncontrolled AST recursion in toString). Fixes SOU-2117.

Dependencies

• tailwindcss and postcss-nested ranges already admit the patched release, so a lockfile refresh resolves them to 6.1.4.
• @tailwindcss/typography pins postcss-selector-parser at exactly 6.0.10, so a qualified resolutions entry forces that range to ^6.1.3.

^{Written for commit 2956cfb. Summary will update on new commits.}

[github-actions]

@claude[bot] your pull request is missing a changelog!

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.