chore(security): bump postcss-selector-parser >=6.1.3 (GHSA-w9m9-85wc-3x92, alert #73)

[benfrank241]

Security bundle — npm / package-lock.json (repo root)

Recreates the Dependabot fix on a human-authored branch so CI runs with repository secrets.

Alert closed

Alert	Advisory	Severity	Package	Scope
#73	GHSA-w9m9-85wc-3x92	LOW	postcss-selector-parser	development

Vulnerable range >=6.1.0 <6.1.3 — first patched 6.1.3.

Fix method — overrides (not a direct bump)

postcss-selector-parser is not a direct dependency; it is pulled in transitively by
tailwindcss (^6.1.2) and postcss-nested (^6.1.1), both dev-scope. A direct bump is
therefore not available, so this adds an npm overrides entry:

"postcss-selector-parser": "^6.1.3"

Both declaring parents accept ^6.1.x, so a global override satisfies them — no scoped
override needed, and no major-version bump (the 7.x line is deliberately avoided).

Lockfile regenerated with npm install --package-lock-only. Resolved 6.1.2 → 6.1.4.
The whole change is 5 added / 2 removed lines: one overrides entry plus the single lock
entry's version/resolved/integrity. No unrelated lockfile churn.

Verification

Check	Result
npm ci	pass
npm run build	see note below
npm run lint	covered by next build's lint phase
npm run test	no test script in this repo — skipped

npm run build fails on this branch — and fails identically on unmodified main. The
failure is a pre-existing ESLint gate in source files, entirely unrelated to dependencies:

./src/app/api/createSourceConnector/route.ts
116:19  Error: Unexpected any.  @typescript-eslint/no-explicit-any
./src/app/api/manage-oauth-user/[connectorId]/route.ts
16:34  Error: Unexpected any.  @typescript-eslint/no-explicit-any

Baseline and branch were built side by side; the normalized error/warning sets are
identical (2 errors, 4 warnings on both). The Compiled successfully phase passes on
both — only the lint gate fails.

To confirm the bump itself is behaviour-neutral, both sides were then built with the
pre-existing lint gate bypassed locally (a temporary, uncommitted next.config.ts edit,
reverted afterwards):

• both builds exit 0
• the emitted stylesheet is byte-identical between 6.1.2 and 6.1.4
  (.next/static/css/aad988ea4aad36b6.css, 12974 bytes on both)

Since postcss-selector-parser is CSS tooling, identical CSS output is the meaningful
signal here. The repo's only CI workflow is the GitLeaks secret scan, which is unaffected.

The pre-existing lint failure is reported separately in the backlog issue; it is not
introduced by this PR and is not treated as a blocker for this security fix.

---

Please review and merge — this branch is never merged automatically.