Override postcss-selector-parser to 7.1.6 under tailwind 3

tailwind 3 asks for postcss-selector-parser ^6, which held the alert's fixed release (7.1.6) out of reach. Built both ways: the CSS tailwind emits is byte-for-byte the same (index-DNViMQS2.css, 45,648 bytes), so the override changes nothing but the vulnerable parser. tsc clean, vitest passes.

package-lock.json

@@ -8452,9 +8452,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
-      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
+      "version": "7.1.6",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz",
+      "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==",
       "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",

package.json

@@ -90,6 +90,7 @@
   },
   "overrides": {
     "axios": "^1.20.0",
-    "ws": "^8.21.0"
+    "ws": "^8.21.0",
+    "postcss-selector-parser": "^7.1.6"
   }
 }