build(deps-dev): bump postcss from 8.5.23 to 8.5.25

[dependabot]

Bumps postcss from 8.5.23 to 8.5.25.

Release notes

Sourced from postcss's releases.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

Changelog

Sourced from postcss's changelog.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

Commits

• 08c989c Release 8.5.25 version
• 24f6814 Fix 8.5.17 visitor regression
• f2fa53f Add supply chain security requirement to PostCSS plugin guide
• 10edf0b fix: return empty array for empty string in list.split (#2121)
• 0ebe8ad Release 8.5.24 version
• 73218c6 Update dependencies
• 9a114f6 Preserve the BOM when stringifying (#2119)
• 9069261 Fix types check
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Ready	Preview, v0	Aug 4, 2026 6:04am

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ee7a1b1.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/postcss	^8.5.25	Unknown	Unknown

Scanned Files

• apps/web/package.json

[github-actions]

Agent Completion Truth Gate: NOT_APPLICABLE

Evidence agrees.

Machine-readable verdict

{
  "details": {},
  "reasons": [],
  "verdict": "not_applicable"
}

Workflow evidence

[groupthinking]

Review (requested) — dev-dependency patch bump, safe on the merits.

Scope is exactly two lines in apps/web/package.json: postcss ^8.5.23 → ^8.5.25, bumped in lockstep in both devDependencies and the overrides block — correct, since leaving the override behind would have silently pinned the old version. postcss is a build-time (dev) tool; 8.5.24/8.5.25 are bug-fix-only releases (BOM preservation on stringify, an 8.5.17 visitor regression, and list.split() on non-string values). No runtime/API surface change and, unlike some other pending Dependabot PRs, no prepare/install-script supply-chain surface here.

Verification: code CI is green on head ee7a1b1 — build, test, lint-frontend, npm-audit, CodeQL, gitleaks, and dependency-review all pass. The only red checks are the repo governance gates (PR Governance, Canonical issue and evidence), which are non-required (mergeable_state: unstable) and demand a human-linked Closes #<issue> + evidence that a Dependabot PR body can't self-supply.

Recommendation: ✅ Mergeable on the merits. I'm leaving this as a comment rather than a formal approval — the approve/merge to protected main is the human publish step, and this run is unattended. Merge when you're ready to proceed past the (non-required) governance gate.

---

Generated by Claude Code

[dependabot]

Looks like postcss is up-to-date now, so this is no longer needed.

[groupthinking]

·@·d·ependabot r·ebase

This PR is currently mergeable_state: dirty (lockfile conflict against main) while all CI checks are green. Rebasing to clear the conflict so it is ready for a maintainer to merge.

---

Generated by Claude Code