build(deps-dev): Bump postcss from 8.5.16 to 8.5.17 in /webui

[dependabot]

Bumps postcss from 8.5.16 to 8.5.17.

Release notes

Sourced from postcss's releases.

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Changelog

Sourced from postcss's changelog.

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Commits

• 74e25ae Release 8.5.17 version
• d1518af Fix Maximum call stack size exceeded error
• 2421312 Fix linter
• a50352c Fix CI
• 33948f0 Prevent prototype hijacking in fromJSON
• 2131909 Update dependencies
• 93440ab Fix non-closed \<div align="center"> in README (#2110)
• 1bf9076 Remove old sponsors
• 2d44be0 docs: fix invalid JS in writing-a-plugin examples (#2107)
• 3298727 Fix Input#origin() mixing null and undefined for unmapped end position (#2106)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cursor]

Bug Scan Summary

Date: 2026-07-12
Commits inspected: PR #334 (8f3fdcc..b2903d5); also 949198b..origin/master (2 merged dep commits: #331 globals, #333 immer)
Result: No critical bugs found.

PR #334 (postcss 8.5.16 → 8.5.17)

• Scope: webui/package.json + lockfile only; postcss is a devDependency used at CSS build time (Vite/Tailwind), not a production runtime path.
• Release notes (8.5.17): fixes stack-overflow, prototype-hijacking in postcss.fromJSON(), and Input#origin() edge case — security/correctness fixes, not regressions.
• Validation: npx vitest run — 154/154 pass on this branch.
• Below critical bar: nested postcss@8.5.15 inside @tailwindcss/postcss remains (build-only dual-version; same as prior scans).

Master delta since last scan

• #333 immer 11.1.8→11.1.11 (prod dep in ConfigView): includes prototype-pollution CVE fix and draft-map correctness fixes — beneficial, not a regression trigger.
• #331 globals 17.6.0→17.7.0 (eslint dev dep): no production impact.

Known issues elsewhere (not introduced by this PR)

Two v6.12.4 import-finalize regressions (f49384b) remain on master; fix already exists in draft PR #330 (cursor/bug-finding-automation-2303). Not opening a duplicate PR.

Deduplication check

• Open PRs: searched import finalize, IsFileFiltered, IsImportedAsync, postcss — #330 (import fix, draft), #334 (this PR, dep-only); others dep-only.
• Merged PRs (14d): #333, #331, #327, etc. — all dependency bumps; no import-fix merge.
• Open issues: 0.
• Conclusion: No new critical bugs in this PR; no duplicate fix PR needed.

  

_{Sent by Cursor Automation: Torrentarr - Find critical bugs}

[cursor]

PR Validation (Cursor Automation)

Recommendation: Merge
Primary reason: Clean dependency-only webui devDependency bump; the post-merge backend and frontend validation gates all passed.

Gates

Gate	Status	Notes
Merge conflicts	Pass	origin/dependabot/npm_and_yarn/webui/postcss-8.5.17 merged cleanly with origin/master; conflicts: none.
dotnet build	Pass	dotnet build -c Release succeeded with 0 warnings and 0 errors.
dotnet test (non-live)	Pass	dotnet test -c Release --no-build --filter "Category!=Live" passed: 779 passed, 0 failed, 0 skipped.
vitest	Pass	npx vitest run passed: 16 files, 154 tests.
npm run build (webui)	Pass	npm run build (tsc -b && vite build) succeeded.

Validation

Axis	Score	Notes
Purpose	Pass	Updates the postcss devDependency from 8.5.16 to 8.5.17 in webui, a justified maintenance dependency refresh.
Correctness	Pass	Minimal package manifest and lockfile changes; no Torrentarr runtime, config, qBit/Arr, database, or process-isolation logic touched.
Tests	Pass	Full non-live .NET suite and frontend Vitest suite passed; test totals are above the documented baseline.
Hygiene	Pass	Scope is limited to webui/package.json and webui/package-lock.json; no generated wwwroot, temp files, SDK junk, or unrelated changes are included.
Overlap	Pass	No duplicate/better open PR found for this postcss/webui bump; known winner list themes are unrelated.

Why

This PR is a narrow Dependabot devDependency bump. The local validation merge against current master was clean, npm ci accepted the merged lockfile, and all required build/test gates passed. Required docs checked: AGENTS.md, CLAUDE.md, and docs/parity/contract-baseline.md; no docs/audits/pr-triage-*.md file exists in this checkout, so overlap was checked against the prompt's known-winner list plus open PR search.

Overlap

None.

Commands run

• git fetch origin master
• git fetch origin dependabot/npm_and_yarn/webui/postcss-8.5.17
• git checkout -B pr-validate origin/dependabot/npm_and_yarn/webui/postcss-8.5.17
• git merge origin/master
• dotnet restore
• dotnet build -c Release
• dotnet test -c Release --no-build --filter "Category!=Live"
• cd webui && npm ci
• cd webui && npx vitest run
• cd webui && npm run build
• gh pr list --repo Feramance/Torrentarr --state open --search "postcss webui" --json number,title,headRefName,url,author

  

_{Sent by Cursor Automation: Torrentarr PR validation triage}

[dependabot]

A newer version of postcss exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.