[sbc1-code]

Typography 0.5.19 pins postcss-selector-parser 6.0.10, which has quadratic work on flat class/id selectors (GHSA-rj75-hqrm-r3gf). Scope an npm override to that plugin's parser and use the official 6.1.5 security backport. Typography and every other package version remain unchanged; npm only hoists the replaced parser.

The inspected consumer is the repository CSS build plugin. No visitor-controlled selector parsing consumer was found in browser/API code; this is bounded reachability review, not a claim of zero overall risk.

Sources and remaining alerts:

• Maintainer advisory and 6.1.5 backport release identify 6.1.5 as patched for the 6.x line.
• The reviewed advisory range still says <7.1.6. Current npm audit therefore continues to report two moderate package entries; omit-dev reports zero. No findings are dismissed and no audit exception or threshold changes.
• Existing PR deps(deps-dev): bump @tailwindcss/typography from 0.5.19 to 0.5.20 #84 updates Typography to 0.5.20, which still pins 6.0.10; that parent update is separate.

Validation on this source tree:

• Clean npm ci, baseline/candidate builds and full npm test PASS: 136 unit tests and 404 manifest browser navigations, including existing EN/ES desktop/mobile regressions.
• All 25 generated JS/CSS assets are byte-identical before/after. Entry JS 61.81/62 KiB gzip, CSS 19.09/20; budgets unchanged.
• Three new tests resolve the actual Typography parser, preserve six selector/pseudo-element transformations, and bound a flat 400KB/200000-node case in a heap-limited worker. Original 6.0.10 fails the five-second deadline; the backport completes locally in about 130–140ms. These are controlled regression observations, not user-performance measurements.

Four files: package/lock, focused regression wired into the existing suite, and a dated runbook note. No runtime, feed, ads, tracking, account or security-setting changes. Review-only PR: no merge or deployment in this pass.