[kylemh]

What: Remove a malicious payload from postcss.config.js on main, and move the toolchain to Node 26.12.1, pnpm 12.15.0, the latest GitHub Action majors, and the latest version of every dependency except TypeScript.

Why: On Oct 8, talbshoam force-pushed the dependabot branch behind #2020 with an unsigned commit that still claims dependabot as author (committer davidvicos1). That commit appended obfuscated JS after a long run of whitespace on line 5 of postcss.config.js. The code reads a pointer from Ethereum transactions, XOR-decodes a script stored in BSC transaction data, and evals it with require access, so every build, dev server, and Storybook run since then has executed remote code. Linting never saw it: lint:ci only covered src/, and the ESLint project service rejected root config files. Separately, Node and pnpm both shipped security releases this week. TypeScript stays on 6.0 because typescript-eslint peers typescript <6.1.0.

Fix: Restore the original 5-line postcss.config.js, let ESLint's project service cover root *.config.{js,mjs}, and change lint:ci to eslint . so a payload like this fails CI. .nvmrc pins 26.12.1 and packageManager pins pnpm 12.15.0 (pnpm/action-setup@v6, setup-node@v7). Dependency majors that needed code changes: Sentry 11 moved withSentryConfig to @sentry/nextjs/config, jest-dom 7 needs its /vitest entry, and no-barrel-files 2 renamed its flat config. SVG snapshots changed only because the test-only vite-plugin-magical-svg 1.10 swaps viewBox for width/height. A webpack-dev-middleware override clears a high audit advisory. Sentry 11 also reports Vercel environments as production/preview instead of vercel-production/vercel-preview. Merging this does not undo the exposure: rotate every Vercel env var and Actions secret, and review repo write access.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
operation-code	Ready	Preview	Oct 22, 2026 2:14am UTC
storybook	Ready	Preview	Oct 22, 2026 2:14am UTC

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	51.86%	348 / 671
🔵	Statements	52.79%	368 / 697
🔵	Functions	56.55%	164 / 290
🔵	Branches	65.31%	194 / 297

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/components/Forms/RegistrationForm/RegistrationForm.tsx	89.28%	85.71%	85.71%	89.28%	90, 240, 269

Generated in workflow #138 for commit 734998f by the Vitest Coverage Report Action

[kylemh]

Do not merge: main contains a malicious payload in postcss.config.js (introduced via hijacked PR #2020). Cleaning main first.