fix(deps): patch postcss and cryptography security advisories

[cameroncuster]

Patches the two open Dependabot security advisories.

Changes

• postcss 8.5.22 -> 8.5.26 in pnpm-lock.yaml (Dependabot feat(settings): import Codeforces solved problems #47, medium): fixes GHSA where an attacker-controlled sourceMappingURL could read arbitrary .map files when from is unset. Bumped via pnpm update postcss --recursive; transitive-only, no package.json change.
• cryptography 49.0.0 -> 50.0.0 in scripts/requirements.txt (Dependabot fix(db): replace blanket GRANT ALL with least-privilege Supabase grants #46, high): fixes the PKCS#7 EnvelopedData Bleichenbacher oracle. Regenerated with uv pip compile --upgrade-package cryptography ... using the documented command; only the cryptography pin and its hashes changed.

Validation

• pnpm run check — 0 errors, 0 warnings
• pnpm run test — 455/455 pass
• pnpm run build — succeeds

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gitgud	Ready	Preview	Aug 12, 2026 7:14pm

[cameroncuster]

^{Verifier 🧪}

⚪ Could not verify

This PR is a pure dependency-pin security bump with no runtime-observable surface to exercise from this runner, so there is nothing to drive end-to-end against the running app. The two changed files break down as:

• pnpm-lock.yaml — postcss 8.5.22→8.5.26 (and its transitive nanoid 3.3.16→3.3.18). postcss is a build-time-only CSS toolchain dependency; it is not imported anywhere in src/, and the advisory concerns sourceMappingURL/.map reads during CSS processing, which is build-tool behavior, not served-app behavior. The served app's runtime output is identical before and after — no revert delta is observable against the running system.
• scripts/requirements.txt — cryptography 49.0.0→50.0.0 (a transitive dep of google-genai, regenerated hashes only). This lives entirely within scripts/, the offline Python data-classification tooling, which has no deployed web surface and is off-surface for this verifier.

Re-running lint / type-check / build here would only duplicate CI and proves nothing about the running system, so I did not treat that as verification. The PR's own stated checks (pnpm run check, pnpm run test 455/455, pnpm run build) cover the toolchain-integration risk; the scripts/ cryptography bump is best confirmed by python -m pytest scripts/, which runs off-surface here.

_{Ran on 960d679}

[cameroncuster]

^{PR Risk Analyzer Agent 🛡️}

👀 Human review needed

Justification

The change is confined to two lockfiles and contains no application source, schema (sql/), RLS, CI (.github/), or agent-config (.augment/, AGENTS.md) edits, so no automatic-review exclusion path is triggered.

Confirmed content of the diff against main:

• pnpm-lock.yaml: postcss 8.5.22 → 8.5.26 (plus transitive nanoid 3.3.16 → 3.3.18 and re-pinned postcss dependents). No package.json change.
• scripts/requirements.txt: cryptography 49.0.0 → 50.0.0 (plus regenerated hash lists for transitive deps such as charset-normalizer / google-auth; no other pinned version changed).

Why this is routed to a human rather than auto-approved:

• The adopting bundle's automatic ready-for-review approval policy does not affirmatively declare dependency/security bumps as an auto-approvable change class; it defines only the always-review exclusion list. Under the fail-closed rule, an undeclared change class is routed to human review.
• cryptography 49 → 50 is a cross-major upgrade of a cryptographic library and can carry behavioral/compatibility changes beyond the advisory fix; postcss is a build-time transform dependency. Verifying compatibility requires build/test judgment, which this static analyzer does not perform.
• The author-reported validation (check / test / build) is asserted in the PR description and not independently executed here. Head CI is largely green (quality, build-performance, python, node26-compat, CodeQL passing) with unit-coverage and mocked-e2e still in progress at analysis time.

_{Reviewed commit 960d679}

^{Pair Reviewer 🧭}

→ Pair Review Briefing

_{Reviewed commit 960d679}

[cameroncuster]

^{Deep Code Review Agent🐛}

Review completed with 0 suggestions.

_{Reviewed commit: 960d679}