@tailwindcss/typography pins a vulnerable postcss-selector-parser (GHSA-rj75-hqrm-r3gf) #91

Problem

bun audit reports a moderate advisory:

postcss-selector-parser@6.0.10
  @tailwindcss/typography > postcss-selector-parser
  moderate: PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion (<7.1.6) - https://github.com/advisories/GHSA-rj75-hqrm-r3gf

@tailwindcss/typography 0.5.20, the latest release, pins postcss-selector-parser to exactly 6.0.10, so a normal update can't pick up the fix in 7.1.6.

Present on main (17ade4e) and #87.

Impact

Low. The parser only runs while Tailwind compiles the app's own CSS (@plugin "@tailwindcss/typography" in src/styles.css). App code never imports it, it isn't in the build output, and no user input reaches it. CI's bun audit --audit-level=high doesn't fail on it.

Possible fixes

• Wait for Update postcss-selector-parser to v7.1.6 tailwindlabs/tailwindcss-typography#429 (bumps it to 7.1.6, open since 2026-10-11), then update @tailwindcss/typography.
• Or add "postcss-selector-parser": "^7.1.6" to overrides in package.json now. Because 7.x is a major bump, check that the prose styles still compile the same.