fix(deps): keep Hermit on patched web packages

[vincentkoc]

What Problem This Solves

Resolves vulnerable React Router and PostCSS versions in Hermit's application and transitive build graph.

Why This Change Was Made

React Router moves to 8.3.0 and PostCSS to 8.5.23, with a root override keeping every transitive PostCSS instance on the patched floor.

User Impact

Hermit retains the same behavior while its routing and CSS toolchain use patched releases.

Evidence

• TypeScript typecheck
• 255 tests passed
• targeted dependency tests: 3 passed
• autoreview: clean, no accepted/actionable findings

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 28, 2026, 2:56 AM ET / 06:56 UTC.

ClawSweeper review

What this changes

The PR updates Hermit’s React Router and PostCSS dependencies, adds a root PostCSS override for transitive installs, and refreshes the Bun lockfile.

Merge readiness

⚠️ Ready for maintainer review - 4 items remain

Keep this PR open for member review. The branch is a narrow security-maintenance update and current main still carries the older React Router and PostCSS pins shown in the PR diff, so it is not obsolete or already implemented; the draft status and absent after-fix runtime evidence mean it should not be treated as ready to merge automatically.

Priority: P2
Reviewed head: 5332aeb3bf9a9239bcabe42b8c4f020a2d3c0d8c
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, cleanly mergeable dependency patch with successful reported checks, pending maintainer confirmation of the transitive override’s necessity and build compatibility.
Proof confidence	🌊 off-meta tidepool	Not applicable: The PR author is a repository MEMBER, so the external-contributor real-behavior-proof gate does not apply; however, a redacted clean-install and CSS-build transcript would materially strengthen review of the global override.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The PR author is a repository MEMBER, so the external-contributor real-behavior-proof gate does not apply; however, a redacted clean-install and CSS-build transcript would materially strengthen review of the global override.
Evidence reviewed	4 items	PR dependency surface: The proposed patch changes only package.json and bun.lock: React Router 8.2.0→8.3.0, PostCSS 8.5.16→8.5.23, and a root PostCSS override pinned to 8.5.23. Current-main gap: The PR’s clean merge base is current main at c2ff35a, and the supplied three-way diff shows current main still declares the older versions; this requested update is not already present on main. Repository policy: The checked-out repository policy requires Bun for package work and treats dependency changes as a normal repository surface; the PR uses a Bun lockfile and does not introduce an alternative package manager.
Findings	None	None.
Security	None	None.

How this fits together

Hermit’s web application depends on React Router at runtime and PostCSS in its CSS build pipeline. package.json declares the desired dependency versions, while bun.lock resolves the concrete application and transitive packages used by installs and builds.

flowchart LR
  A[Application source] --> B[package.json dependency policy]
  B --> C[Bun dependency resolver]
  C --> D[bun.lock resolved packages]
  D --> E[React Router runtime]
  D --> F[PostCSS CSS build pipeline]
  E --> G[Hermit web application]
  F --> G

Loading

Decision needed

Question	Recommendation
Should Hermit retain a repository-wide PostCSS override at 8.5.23, or should the update be limited to the direct dependency after reviewing the resolved transitive graph?	Keep the override: Retain the root override after confirming it is required for the advisory and that the resolved graph and CSS build work.

Why: The override is an intentional dependency-policy choice that affects every transitive PostCSS consumer; the supplied patch does not show why the broader pin is required.

Before merge

• Resolve merge risk (P1) - The root PostCSS override changes every transitive PostCSS resolution, so maintainer review should confirm the locked graph installs and the CSS build still succeeds on a fresh install.
• Resolve merge risk (P1) - The PR claims patched versions without linking the specific advisory or demonstrating the resulting resolved dependency tree, leaving the security objective and upgrade compatibility only partially evidenced.
• Complete next step (P2) - A repository MEMBER authored this draft dependency-policy update, and the remaining question is whether the global PostCSS override is required; that calls for human dependency review rather than automated repair.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency policy changes	2 direct versions updated, 1 root override added	The direct package bumps are narrow, but the override intentionally affects every resolved PostCSS consumer.
Patch scope	2 files affected; 9 additions, 7 deletions	The small lockfile/package-only scope makes a focused dependency and build review practical.

Merge-risk options

Maintainer options:

1. Validate the resolved package graph (recommended)
   Before merge, run a clean Bun install and the production CSS build to confirm the PostCSS override does not break current transitive consumers.
2. Accept the repository-wide pin
   Merge the override as a deliberate security posture if maintainers accept the transitive compatibility risk with the existing lockfile evidence.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Run a clean Bun install and the production CSS build, then attach redacted terminal output showing the resolved PostCSS version and successful build.

Technical review

Best possible solution:

Confirm the advisories and resolved dependency graph, then land this small Bun-managed update once a clean install and production CSS build demonstrate that the override preserves Hermit’s current web behavior.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a user-facing bug reproduction: this PR is a dependency-security update, and the relevant verification is a clean dependency resolution plus a real CSS build/runtime check.

Is this the best way to solve the issue?

Unclear: updating the vulnerable direct packages is a narrow solution, but the supplied evidence does not yet establish that a repository-wide PostCSS override is necessary rather than a direct-version and lockfile update.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c2ff35ab8681.

Labels

Label changes:

• add P2: This is a bounded dependency-security maintenance change that warrants normal maintainer review but has no demonstrated active user-facing regression.
• add merge-risk: 🚨 compatibility: The root PostCSS override can change the version consumed by all transitive CSS-tooling dependencies during installs and upgrades.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR author is a repository MEMBER, so the external-contributor real-behavior-proof gate does not apply; however, a redacted clean-install and CSS-build transcript would materially strengthen review of the global override.

Label justifications:

• P2: This is a bounded dependency-security maintenance change that warrants normal maintainer review but has no demonstrated active user-facing regression.
• merge-risk: 🚨 compatibility: The root PostCSS override can change the version consumed by all transitive CSS-tooling dependencies during installs and upgrades.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR author is a repository MEMBER, so the external-contributor real-behavior-proof gate does not apply; however, a redacted clean-install and CSS-build transcript would materially strengthen review of the global override.

Evidence

What I checked:

• PR dependency surface: The proposed patch changes only package.json and bun.lock: React Router 8.2.0→8.3.0, PostCSS 8.5.16→8.5.23, and a root PostCSS override pinned to 8.5.23. (package.json:29, 5332aeb3bf9a)
• Current-main gap: The PR’s clean merge base is current main at c2ff35a, and the supplied three-way diff shows current main still declares the older versions; this requested update is not already present on main. (package.json:29, c2ff35ab8681)
• Repository policy: The checked-out repository policy requires Bun for package work and treats dependency changes as a normal repository surface; the PR uses a Bun lockfile and does not introduce an alternative package manager. (AGENTS.md:1)
• Review state: The PR is draft, cleanly mergeable, and its available GitHub checks report success, but the PR body supplies only test/typecheck claims rather than an after-fix runtime or build transcript. (5332aeb3bf9a)

Likely related people:

• vincentkoc: The supplied GitHub context identifies vincentkoc as a repository MEMBER and the author of the sole dependency-update commit; no readable local history was available to establish a separate long-term package-area owner. (role: repository member and dependency-update author; confidence: low; commits: 5332aeb3bf9a; files: package.json, bun.lock)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach a redacted clean-install and production CSS-build transcript that shows the final PostCSS resolution.
• Link the advisory or dependency audit evidence that requires the repository-wide PostCSS floor.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[vincentkoc]

Maintainer dependency sign-off: the repository-wide PostCSS floor is intentional because the advisory is reachable through both direct and transitive CSS tooling. Exact head 5332aeb3bf9a9239bcabe42b8c4f020a2d3c0d8c passed typecheck, 255 tests, focused dependency tests, CodeQL, and clean autoreview. The final Bun lock resolves the patched floor; no remaining rank-up blocker.