Security follow-up
Production audit after the July 2026 remediation still reports one moderate advisory: GHSA-qx2v-qp2m-jg93 / CVE-2026-41305 (PostCSS, vulnerable below 8.5.10).
Current paths:
- apps/grok-spiral > next 15.5.18 > postcss 8.4.49
- apps/web > next 15.5.18 > postcss 8.4.49
- apps/web > next-intl 4.13.2 > next 15.5.18 > postcss 8.4.49
Applicability and current mitigation
The issue requires attacker-controlled CSS to be parsed/stringified and embedded into an HTML style context. ground.codes does not accept, store, or render user-supplied CSS. PostCSS is used by the trusted Next build pipeline. The current remediation removes all high and critical production advisories; this moderate is tracked rather than waived silently.
Completion criteria
- Move every production PostCSS path to 8.5.10 or newer through a compatible Next release or reviewed override.
- Run frozen install, production audit, Web/Grok unit/type/build checks, and Web browser smoke.
- Confirm production audit no longer reports GHSA-qx2v-qp2m-jg93.
Security follow-up
Production audit after the July 2026 remediation still reports one moderate advisory: GHSA-qx2v-qp2m-jg93 / CVE-2026-41305 (PostCSS, vulnerable below 8.5.10).
Current paths:
Applicability and current mitigation
The issue requires attacker-controlled CSS to be parsed/stringified and embedded into an HTML style context. ground.codes does not accept, store, or render user-supplied CSS. PostCSS is used by the trusted Next build pipeline. The current remediation removes all high and critical production advisories; this moderate is tracked rather than waived silently.
Completion criteria