[narcisonunez]

Resolves the open Dependabot alerts #309 and #310.

• source-map-js 1.2.1 → 1.2.2 (alert #310, GHSA-68fv-2mgg-jv7q). Transitive via postcss and @tailwindcss/node. Added a source-map-js@>=1.0.0 <1.2.2 override, following the existing pattern.
• postcss-selector-parser 6.1.4 → 6.1.5 (alert #309, GHSA-rj75-hqrm-r3gf). The 6.x copy comes from Tailwind CSS 3 (apps/website) and postcss-nested, which both require ^6. Upstream published 6.1.5 on 2026-10-19 as the official backport of the 7.1.6 fix. I checked the tarball diff: only uniqs() and the index lookups change from indexOf to Set, nothing else. Forcing 7.x on Tailwind 3 would be a major bump, so I avoided it. The 7.x copy (fumadocs-ui) was already on 7.1.6, and its override floor now matches.
• The lockfile diff only touches these two packages.

Note: the GHSA still lists < 7.1.6 as vulnerable with 7.1.6 as the only patched version, so Dependabot may keep #309 open until the advisory adds 6.1.5. If it does, dismiss the alert as "fix available in 6.1.5".

No breaking changes

• apps/website (Tailwind 3) and apps/docs (Tailwind 4 + fumadocs) both build, and the generated CSS is byte-identical before and after.
• pnpm biome ci and pnpm typecheck pass (same steps as CI).
• E2E: served the production build of apps/website. /, /blog, /pricing and /contact return 200, and the home page renders fully styled.