Latest published next (16.3.0) now pins postcss=8.5.23,
which is different from the original vulnerable pin 8.4.31 that
motivated the top-level overrides.postcss entry in package.json
(commit 92f3f2b).
Action: if 8.5.23 is >=8.5.10, the GHSA-qx2v-qp2m-jg93 /
CVE-2026-41305 floor is cleared, and the override can be dropped:
- Remove the
overrides.postcss block from package.json.
npm install and confirm npm ls postcss no longer shows a nested
node_modules/next/node_modules/postcss directory (it should
dedupe to the top-level direct devDep).npm audit must remain at 0 vulnerabilities.- CI build + the smoke suite must still pass.
If 8.5.23 is <8.5.10, leave the override in place — next
has only shifted the pin within the vulnerable range and the override
is still doing real work.
Detected by monitor-next-postcss-pin.yml.
Latest published
next(16.3.0) now pinspostcss=8.5.23,which is different from the original vulnerable pin
8.4.31thatmotivated the top-level
overrides.postcssentry inpackage.json(commit 92f3f2b).
Action: if
8.5.23is >=8.5.10, the GHSA-qx2v-qp2m-jg93 /CVE-2026-41305 floor is cleared, and the override can be dropped:
overrides.postcssblock frompackage.json.npm installand confirmnpm ls postcssno longer shows a nestednode_modules/next/node_modules/postcssdirectory (it shoulddedupe to the top-level direct devDep).
npm auditmust remain at 0 vulnerabilities.If
8.5.23is <8.5.10, leave the override in place — nexthas only shifted the pin within the vulnerable range and the override
is still doing real work.
Detected by
monitor-next-postcss-pin.yml.