[soustruh]

What was wrong

• Dependabot alert feat: auto-update on startup with version cache and re-exec #122 (GHSA-rj75-hqrm-r3gf, medium): postcss-selector-parser 6.1.4 in web/frontend has quadratic complexity in flat selector parsing. The fix is in 7.1.6.
• The package comes only from Tailwind 3, which requires ^6.1.2. No fixed 6.x release exists.
• Dependabot PR chore(deps): bump postcss-selector-parser and tailwindcss in /web/frontend #830 removes it by a move to Tailwind 4. Tailwind 4 moved its PostCSS plugin to @tailwindcss/postcss, so the frontend build fails. The Windows wheel build then fails too, because the UI is missing from the wheel.

What changed

• web/frontend/package.json: an npm overrides entry postcss-selector-parser: ^7.1.6. Tailwind stays on 3.4.
• web/frontend/package-lock.json: postcss-selector-parser 7.1.6.
• The only breaking change in 7.0.0 is that inserting nodes while walking the tree is now safe. The built CSS is byte-identical to the build from main.

Tests

• Node 20, as in CI: npm ci, npx tsc --noEmit, npm test and npm run build pass in web/frontend.
• npm ls shows postcss-selector-parser 7.1.6 everywhere, and npm audit no longer lists it.

After this PR is merged, Dependabot closes #830. A move to Tailwind 4 is separate work: the upgrade tool changes 27 files, and every page needs a visual check.

[keboola-pr-reviewer-bot]

Verdict: auto_approve (risk 1/5) · profile _default

Dev-only npm override bumping a build-time CSS parser to patch a Dependabot security alert; safe to auto-approve.