Yarn Audit: new or newly blocking advisories on main (87d862e8af)

[github-actions]

2 new or newly blocking advisories detected on push to main (2 release-blocking).

CI run: https://github.com/MetaMask/metamask-extension/actions/runs/30108590431

Release-blocking (production, moderate+)

• postcss (high) — PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
  GHSA-r28c-9q8g-f849
• tar (moderate) — node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
  GHSA-r292-9mhp-454m

Native audit tree

├─ postcss
│  ├─ ID: 1124288
│  ├─ Issue: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
│  ├─ URL: https://github.com/advisories/GHSA-r28c-9q8g-f849
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <=8.5.17
│  │ 
│  ├─ Tree Versions
│  │  ├─ 7.0.36
│  │  ├─ 7.0.39
│  │  └─ 8.5.10
│  │ 
│  └─ Dependents
│     ├─ metamask-crx@workspace:.
│     ├─ resolve-url-loader@npm:3.1.5
│     └─ stylelint@npm:13.6.1
│

├─ tar
│  ├─ ID: 1124287
│  ├─ Issue: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
│  ├─ URL: https://github.com/advisories/GHSA-r292-9mhp-454m
│  ├─ Severity: moderate
│  ├─ Vulnerable Versions: <=7.5.20
│  │ 
│  ├─ Tree Versions
│  │  └─ 7.5.20
│  │ 
│  └─ Dependents
│     └─ @metamask/foundryup@npm:1.0.1
│