release: v0.47.4 — postcss security override + Docker smoke CI

[elfensky]

Summary

Release v0.47.4 to production. Rolls up two changes since v0.47.3:

0.47.4 — postcss pinned via package.json#overrides (security)

Remediates GHSA-qx2v-qp2m-jg93 / CVE-2026-41305 (PostCSS XSS via unescaped </style> in stringified CSS, < 8.5.10). The vulnerable copy came in transitively via next@16.2.6 → postcss@8.4.31; Tailwind 4 already pulled postcss@8.5.14 independently, proving the 8.5.x line works in our pipeline.

After install all three postcss consumers (Tailwind, Next, Vite) dedupe to 8.5.15. npm install reports 0 vulnerabilities. Real-world exploit risk for this app is essentially zero (the vuln requires processing user-submitted CSS through PostCSS's stringifier — we author all our own CSS via Tailwind utilities and design tokens), but the override drops us from 1 moderate dependabot alert to 0.

Also picks up a stray dependabot bump that landed on main directly (PR #382): brace-expansion 5.0.5 → 5.0.6 (CVE-flagged ReDoS, also low real-world risk for us).

0.47.2 — Docker smoke CI for main PRs

New .github/workflows/main-pr-docker-smoke.yml (scoped to pull_request: branches: [main]) brings up the full production-shaped stack (postgres + migrate + helldiversbot, all built from working-tree Dockerfiles) and asserts both that migrate exits 0 and that the app's /api/healthcheck returns sensible JSON. Backed by a standalone docker-compose.ci.yml. Cold-cache cost ~7 minutes per main PR.

This PR should be the first one where that workflow actually runs in CI — assuming GitHub's PR workflow resolution picks up the file from the head ref. If it doesn't trigger here (because main doesn't yet have the workflow file), it'll start working on the next main PR.

Verification (local, on develop @ HEAD)

• npm run lint — clean
• npm run typecheck — clean
• npm run test:unit — 1320 tests pass
• npm run build — succeeds
• docker compose -f docker-compose.ci.yml up --build --wait — exit 0 in 1m 11s; migrate seeded all 156 seasons, app reached healthy, curl /api/healthcheck → {"alive":true,...}

Post-merge actions

1. Tag the merge commit on main as v0.47.4 and push the tag — triggers production Docker build via release.docker.yml.
2. Merge main back into develop so develop carries the merge commit.

Test plan

• Existing CI (Test & Build, CodeQL, Dependency Review) green
• Docker smoke workflow — observe whether it triggers (it's new). If it does, expect ~7 min and a healthy stack.
• After merge: v0.47.4 tag pushed, release.docker.yml produces new images
• On production host: sudo docker compose pull && sudo docker compose up — migrate completes, app reaches healthy
• Dependabot alert chore(deps): bump zod from 4.1.13 to 4.2.0 in the minor-and-patch group #98 (postcss) closes once GitHub re-scans the default branch
• main merged back into develop

🤖 Generated with Claude Code