From 9a9480bd02dc7debf77b2b98efdea1ebebb962bd Mon Sep 17 00:00:00 2001
From: Blake Gentry <blakesgentry@gmail.com>
Date: Thu, 22 Oct 2026 09:06:15 -0500
Subject: [PATCH] use selector-parser's 6.1.5 security backport

Tailwind typography pins a parser version with quadratic handling of
repeated class and ID selectors. Its current release still pins that
version.

Override only typography's parser to the maintained 6.1.5 security
backport and lock its published artifact. Bring in the linear-time
parsing fix while retaining the parser major and other dependency
versions.
---
 package-lock.json | 7 ++++---
 package.json      | 3 +++
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 423b7159..a1dc4c7c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7309,9 +7309,10 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.0.10",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.10.tgz",
-      "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==",
+      "version": "6.1.5",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.5.tgz",
+      "integrity": "sha512-TEHFzb5KRDKaOgJ4TYE+0jyJtFbjLvkdVOu0fZ2b6MTWzoqZd4Le+61aEppWkvTlYePgOX4ATL1wsAIPMLTw6Q==",
+      "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
         "util-deprecate": "^1.0.2"
diff --git a/package.json b/package.json
index 3493d67d..33b6b370 100644
--- a/package.json
+++ b/package.json
@@ -73,6 +73,9 @@
   },
   "overrides": {
     "@babel/runtime": "^7.26.10",
+    "@tailwindcss/typography": {
+      "postcss-selector-parser": "6.1.5"
+    },
     "shell-quote": "^1.9.0",
     "storybook": "$storybook"
   },