Possible fix(deps): 3 vulnerable dependencies in package-lock.json

[begininvoke]

This might be a false positive, but demos/features/legend/package-lock.json around line 2637 looked worth a second pair of eyes.

Vulnerability CVE-2026-45623 is a HIGH severity arbitrary file read and path traversal flaw in PostCSS <=8.5.11. When processing CSS input, PostCSS insecurely resolves the 'sourceMappingURL' directive against the local filesystem without validating schemes or enforcing traversal restrictions. Attackers controlling CSS input can exfiltrate file contents (via parsed error messages), conduct precise file enumeration, and trigger resource exhaustion DoS. As this triggers with default options, any system processing untrusted or user-supplied CSS is critically exposed.

Something like this might fix it:

--- a/demos/features/legend/package.json
+++ b/demos/features/legend/package.json
@@ -1,5 +1,5 @@
     "dependencies": {
-        "postcss": "8.4.32",
+        "postcss": "^8.5.12",
         ...
     }

Run `npm install` or `yarn install` to regenerate package-lock.json with the fixed dependency tree.

For reference: rule CVE-2026-45623. Rated high.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.