Tarball clean-install breaks: postcss pin vs cssnano peer range

Context

The v13.0.0 neomjs.com deploy (2026-06-12) died on its first run at the pages deploy script's npm i inside the freshly installed node_modules/neo.mjs:

npm error ERESOLVE unable to resolve dependency tree
npm error Found: postcss@8.5.10  (dev postcss@"8.5.10" from the root project)
npm error Could not resolve dependency:
npm error peer postcss@"^8.5.13" from cssnano@7.1.9  (dev cssnano@"^7.1.3" from the root project)

The deploy was unblocked by copying the repo's package-lock.json from the content clone into node_modules/neo.mjs before the inner install (pages commit f805fcc484 carries that script change). This ticket is the upstream fix so the published package stops needing the workaround.

The Problem

npm tarballs never ship package-lock.json, so any fresh npm i against the published package.json re-resolves floating (dev)dependencies at install time. Neo's devDependency set is internally unresolvable under current registry state:

• postcss is exact-pinned at 8.5.10
• cssnano floats at ^7.1.3, which now resolves to 7.1.9 — whose peer range is postcss@^8.5.13

Repo clones are immune (the committed lockfile holds the tested pair cssnano 7.1.3 + postcss 8.5.10). Every lockfile-less resolution path breaks: deploy flows that build inside the installed package, vendored builds, and any future lockfile regeneration. The shape is a time bomb — it gets worse as cssnano floats further from the pinned postcss.

The Architectural Reality

• package.json:186 — "cssnano": "^7.1.3" (caret)
• package.json:205 — "postcss": "8.5.10" (exact)
• The pin originates from commit 075ee8905 ("postcss dependecy update to fix a vulnerability"), which replaced the prior caret ^8.5.8. The intent was a security floor, not a regression ceiling — raising postcss further preserves that intent.
• postcss drives the themes pipeline (themes.mjs:9, processing at line ~277), with cssnano among its plugins — the pair must stay peer-compatible.
• Registry state at filing: postcss latest 8.5.15; cssnano@7.1.9 peer postcss@^8.5.13 (verified via npm view).

The Fix

1. Bump postcss from 8.5.10 to ^8.5.13 (or straight to current 8.5.15) in devDependencies.
2. Refresh package-lock.json.
3. Verify the themes build is green post-bump.

Lands with the next patch release so the 13.0.1+ tarball clean-installs.

Decision Record impact: none (dependency hygiene; no consumed-surface change, so no Contract Ledger).

Acceptance Criteria

• postcss devDependency is a range satisfying cssnano@^7's current peer requirement (^8.5.13 or later); lockfile refreshed.
• Lockfile-less resolution succeeds (reproduces the tarball-install path): in a copy of package.json without a lockfile, npm i --package-lock-only --no-audit exits 0.
• Themes build green post-bump (themes path of npm run build-all, or buildScripts/build/themes.mjs directly).

Release classification: post-release (published 13.0.0 is not retroactively fixable; the pages deploy script carries a lockfile-copy workaround — this lands with 13.0.1).

Out of Scope

• The pages deploy script (already fixed independently: lockfile copy, pages commit f805fcc484).
• npm publish flow / .npmignore changes (shipping a lockfile in the tarball is not an npm-supported mechanism).
• A broader exact-pin-vs-floating-peer dependency audit (worth a one-line check during the bump, but not this ticket's deliverable).

Sweep Evidence

• Live latest-open sweep: checked latest 20 open issues at 2026-06-12T14:10Z; no equivalent found.
• A2A in-flight claim sweep (last 30 messages, all read-states): no overlapping [lane-claim]/[lane-intent].
• Local grep over resources/content/issues/ + resources/content/discussions/ for postcss/cssnano: none.
• KB semantic sweep: degraded (embedding timeout) — treated as unknown rather than no-match, compensated by the three sweeps above.

Related

• Pages workaround commit: neomjs/pages@f805fcc484 (lockfile copy in buildScripts/updateNeoVersion.mjs)
• Pin origin: 075ee8905
• Empirical failure log: v13.0.0 deploy run 1, 2026-06-12T13:45Z

Origin Session ID: c4caff26-d818-486b-8663-19b85ac3cc11 Retrieval Hint: "v13 pages deploy ERESOLVE postcss cssnano lockfile tarball clean-install"