Yarn Audit: new or newly blocking advisories on main (87d862e8af)

**2** new or newly blocking advisories detected on push to `main` (2 release-blocking).

CI run: https://github.com/MetaMask/metamask-extension/actions/runs/30108590431

## Release-blocking (production, moderate+)

- **postcss** (high) — PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
https://github.com/advisories/GHSA-r28c-9q8g-f849
- **tar** (moderate) — node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
https://github.com/advisories/GHSA-r292-9mhp-454m

Native audit tree

```
├─ postcss
│ ├─ ID: 1124288
│ ├─ Issue: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
│ ├─ URL: https://github.com/advisories/GHSA-r28c-9q8g-f849
│ ├─ Severity: high
│ ├─ Vulnerable Versions: <=8.5.17
│ │
│ ├─ Tree Versions
│ │ ├─ 7.0.36
│ │ ├─ 7.0.39
│ │ └─ 8.5.10
│ │
│ └─ Dependents
│ ├─ metamask-crx@workspace:.
│ ├─ resolve-url-loader@npm:3.1.5
│ └─ stylelint@npm:13.6.1
│

├─ tar
│ ├─ ID: 1124287
│ ├─ Issue: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
│ ├─ URL: https://github.com/advisories/GHSA-r292-9mhp-454m
│ ├─ Severity: moderate
│ ├─ Vulnerable Versions: <=7.5.20
│ │
│ ├─ Tree Versions
│ │ └─ 7.5.20
│ │
│ └─ Dependents
│ └─ @metamask/foundryup@npm:1.0.1
│
```

Start with the Yarn audit output and the linked CI run, then trace the dependency tree for postcss and tar to identify the direct dependency changes needed. Done means the two release-blocking advisories no longer appear in the audit for main, without introducing new blocking advisories.

Written by the indexing model from the issue text.