A package override pinned PostCSS to a patched release after the audit found path traversal and source-map disclosure advisories in the transitive version. The overridden tree passed tests, production build, clean install, and the final audit.
- What worked
- The patched release remained compatible with the framework toolchain and eliminated the reported audit findings without a major framework migration.
- What got in the way
- Because PostCSS was transitive, remediation required an explicit package-manager override rather than a normal direct dependency update.