fix: keep dependency audit on patched releases

[kang-heewon]

Outcome

Workspace and generated-application dependency overrides now require PostCSS 8.5.18, the first release patched for GHSA-r28c-9q8g-f849. The workspace also requires brace-expansion 5.0.8 for the affected modern range, closing GHSA-mh99-v99m-4gvg in runtime, generated-app, and release-evidence paths.

The dependency-audit fixture and generated template security contract are synchronized, and a patch changeset covers create-croco-app.

Verification

• pnpm security:audit-policy — passed
• pnpm audit --audit-level high --prod — no unreviewed high finding
• Dependency audit policy suite — 52/52 tests
• create-croco-app suite — 131/131 tests
• Repository verification — 21/22 applicable gates passed
• Pre-push workspace tests — 226/226 tasks
• Pre-push workspace typecheck — 225/225 tasks
• Frozen lockfile and diff checks — passed

Review gates

• Correctness and regression: PASS — template fixtures fail against the prior PostCSS pin and pass at 8.5.18; the audit policy executes successfully against the updated lockfile.
• API, security, compatibility, and release: PASS — both overrides use the first patched releases, generated workspaces inherit the PostCSS remediation, and the dedicated patch changeset covers the published generator behavior.
• Maintainability and minimality: PASS — the diff is limited to the two overrides, mechanical lock resolution updates, two generated-workspace templates, their existing contract, the audit fixture, and one changeset.
• Independent adversarial review: APPROVE — no actionable findings after isolating the remediation from the cache TTL issue.

Residual risk

The production audit still reports lower-severity findings and one explicitly reviewed high finding under the repository security policy. This change is limited to the two newly blocking advisories.

Summary by CodeRabbit

• 보안

  • 생성되는 애플리케이션에서 PostCSS를 8.5.18로 고정해 소스맵 경로 순회 취약점과 관련된 위험을 줄였습니다.

• 개선 사항

  • 의존성 감사 및 템플릿 검증 기준을 최신 PostCSS 버전에 맞게 업데이트했습니다.
  • 관련 패키지 버전 제약을 조정해 보안 업데이트가 일관되게 적용되도록 했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 671bcff3-15e0-488e-85a9-8030fe0cae4c

📥 Commits

Reviewing files that changed from the base of the PR and between 68352be and df6d73e.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (6)

• .changeset/secure-generated-dependency-audit.md
• packages/create-croco-app/src/tests/NextTemplateSecurity.spec.ts
• packages/create-croco-app/templates/blank/pnpm-workspace.yaml
• packages/create-croco-app/templates/spa-be-split/pnpm-workspace.yaml
• pnpm-workspace.yaml
• scripts/dependency-audit-policy.mts

---

📝 Walkthrough

Walkthrough

워크스페이스와 생성 템플릿의 PostCSS 오버라이드를 8.5.18로 갱신하고, 감사 정책과 보안 테스트의 기대값 및 create-croco-app changeset을 업데이트했습니다. 루트 brace-expansion 버전 범위도 조정되었습니다.

Changes

PostCSS 보안 업데이트

Layer / File(s)	Summary
워크스페이스 오버라이드 갱신 pnpm-workspace.yaml, packages/create-croco-app/templates/*/pnpm-workspace.yaml	루트 및 생성 템플릿의 postcss 오버라이드를 8.5.12에서 8.5.18로 변경하고, brace-expansion 허용 상한을 <5.0.8로 조정했습니다.
감사 정책과 검증 반영 scripts/dependency-audit-policy.mts, packages/create-croco-app/src/tests/NextTemplateSecurity.spec.ts, .changeset/secure-generated-dependency-audit.md	생성 템플릿 감사 설정과 보안 테스트 기대값을 PostCSS 8.5.18에 맞추고, create-croco-app patch changeset을 추가했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• croco-dev/framework#1208: 의존성 감사 정책에서 생성되는 워크스페이스의 PostCSS 오버라이드와 관련된 변경입니다.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목이 dependency audit를 패치된 릴리스에 맞추는 변경을 간결하게 요약해 PR의 핵심과 잘 맞습니다.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependency-audit-advisories

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Benchmark Results

✅ All benchmarks passed

Benchmark	p75	Threshold	Baseline	vs Baseline	Status	Notes
CrocoApp constructor	8.1μs	30.0ms	8.2μs	-0.6%	✅	-
CrocoApp lambdaHandler (10 controllers)	272.7μs	50.0ms	258.4μs	+5.5%	✅	-
Lambda cold-start simulation	477.3μs	80.0ms	418.1μs	+14.2%	✅	-
Lambda cold-start with headers	392.2μs	80.0ms	369.7μs	+6.1%	✅	-
Lambda cold-start with binary body	372.4μs	80.0ms	339.1μs	+9.8%	✅	-
Lambda cold-start with query params	322.2μs	80.0ms	301.3μs	+6.9%	✅	-
Lambda cold-start with authorizer context	320.3μs	80.0ms	299.8μs	+6.8%	✅	-
Lambda cold-start realistic scenario	319.7μs	80.0ms	299.2μs	+6.9%	✅	-
EventBusConfig.start (10 handlers)	1.5μs	10.0ms	1.4μs	+4.8%	✅	-
EventPublisher.publishNow single event	1.8μs	2.0ms	1.7μs	+4.8%	✅	-
DefaultHandlerResolver.resolve × 10	0.1μs	5.0ms	0.1μs	+0.0%	✅	-
Container.get singleton (cold)	76.4μs	5.0ms	70.3μs	+8.8%	✅	-
Container.register × 50 components	3.4ms	10.0ms	3.2ms	+4.7%	✅	-
Container.validate (50 components)	3.8ms	20.0ms	3.4ms	+13.5%	✅	-
Container.get singleton (warm)	1.6μs	500.0μs	1.6μs	-0.6%	✅	-
TelemetryRuntime.init (lambda preset)	2.3μs	200.0ms	1.1ms	-99.8%	✅	-
lambdaPreset config creation	1.5μs	2.0ms	1.4μs	+5.0%	✅	-

_{Updated: 2026-07-25T04:45:19.588Z · Commit: 0e90e1f}