Remediate Next bundled PostCSS advisory (#7)

.github/pull_request_template.md

@@ -21,7 +21,7 @@
 - [ ] No secrets, private payloads, local reports, or process files committed
 
 ## Commands Run
-- [ ] `npm run check:audit:prod-high`
+- [ ] `npm run check:audit:prod`
 - [ ] `npm run generate:tool-index`
 - [ ] `npm run check:tool-index`
 - [ ] `npm run generate:client-tool-lookup`

.github/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
         run: npm ci
 
       - name: Run Production Dependency Audit
-        run: npm run check:audit:prod-high
+        run: npm run check:audit:prod
 
       - name: Run ESLint
         run: npm run lint

docs/security/next-postcss-advisory-runbook.md

@@ -1,47 +1,51 @@
 # Next Bundled PostCSS Advisory Runbook
 
-This runbook tracks issue #7: GHSA-qx2v-qp2m-jg93 through Next.js bundled `postcss`.
+This runbook records the remediation for issue #7: GHSA-qx2v-qp2m-jg93 through
+Next.js bundled `postcss`.
 
-The issue must stay open until a stable Next.js release bundles `postcss >= 8.5.10`, or an upstream non-applicable determination is documented.
+## Stable Remediation
 
-## Current Stable Evidence
+Checked on 2026-07-16:
 
-Checked on 2026-06-27:
+- `npm view next version`: `16.2.10`
+- `npm view @next/bundle-analyzer version`: `16.2.10`
+- Stable Next still declares vulnerable `postcss@8.4.31`.
+- The project keeps Next, `@next/bundle-analyzer`, and `eslint-config-next` aligned at
+  stable `16.2.10`.
+- A controlled npm override replaces only Next's internal PostCSS copy with
+  `postcss@8.5.10`, the first patched version already used by Next 16.3 canaries.
 
-- `npm view next version`: `16.2.9`
-- `npm view @next/bundle-analyzer version`: `16.2.9`
-- `npm view next@latest dependencies --json`: bundled `postcss` is `8.4.31`
-- Project dependency: `next@16.2.9`
-- Project dev dependency: `@next/bundle-analyzer@16.2.9`
+This avoids the unsafe framework downgrade proposed by `npm audit fix --force`, does
+not suppress the advisory, and keeps the application on a stable Next release.
 
-This does not meet the closing requirement because `8.4.31 < 8.5.10`.
-
-## Stable Remediation Check
-
-Run on a dedicated branch:
-
-```bash
-git checkout main
-git pull --ff-only origin main
-git checkout -b chore/next-postcss-stable-check
-npm view next version
-npm view @next/bundle-analyzer version
-npm view next@latest dependencies --json
-```
-
-If stable Next bundles `postcss >= 8.5.10`, update Next and bundle analyzer together:
+After `npm ci`, verify the effective dependency and production audit:
 
 ```bash
-npm install next@<stable-version> @next/bundle-analyzer@<stable-version> --package-lock-only
-npm ci
 node -p "require('./node_modules/next/package.json').version"
 node -p "require('./node_modules/next/node_modules/postcss/package.json').version"
 npm audit --omit=dev --json
 ```
 
-Required validation before closing #7:
+Expected results:
+
+- Next reports `16.2.10`.
+- Next's effective PostCSS reports `8.5.10`, satisfying `postcss >= 8.5.10`.
+- The production audit reports 0 moderate/high/critical vulnerabilities and no
+  `next -> postcss` advisory path.
+
+## Upstream Evidence
+
+- Advisory: https://github.com/advisories/GHSA-qx2v-qp2m-jg93
+- Next PostCSS 8.5.10 bump: https://github.com/vercel/next.js/pull/93288
+- Next applicability discussion: https://github.com/vercel/next.js/issues/93234
+
+## Regression Validation
+
+Run the complete release-sensitive validation set whenever the Next version or
+override changes:
 
 ```bash
+npm run check:audit:prod
 npm run check:audit:prod-high
 npm run lint
 npm test
@@ -59,6 +63,8 @@ npm run test:e2e:pwa
 - Do not merge Next canary into `main` without an explicit project decision.
 - Do not suppress the advisory without upstream evidence.
 - Do not loosen production audit gates.
+- Do not remove the override until stable Next resolves PostCSS to `8.5.10` or newer
+  without it.
 
 ## Closure Comment Template
 
@@ -72,6 +78,7 @@ Tester:
 Stable Next version:
 Bundled postcss version:
 npm audit --omit=dev result:
+check:audit:prod:
 check:audit:prod-high:
 lint:
 test: