postcss <=8.5.17 discloses arbitrary .map files through path traversal in the previous-source-map auto-loader (GHSA-r28c-9q8g-f849, high), fixed in 8.5.18. Transitive via @docusaurus/core; the docs-site lockfile pins 8.5.14 and the existing postcss: >=8.5.10 override still permits the vulnerable range. Raise the floor in website/pnpm-workspace.yaml. The Trivy filesystem scan blocks non-docs PRs until it resolves.
postcss <=8.5.17 discloses arbitrary
.mapfiles through path traversal in the previous-source-map auto-loader (GHSA-r28c-9q8g-f849, high), fixed in 8.5.18. Transitive via @docusaurus/core; the docs-site lockfile pins 8.5.14 and the existingpostcss: >=8.5.10override still permits the vulnerable range. Raise the floor inwebsite/pnpm-workspace.yaml. The Trivy filesystem scan blocks non-docs PRs until it resolves.