diff --git a/.git-hooks/commit-msg b/.git-hooks/commit-msg
index 5c521a9..fae05ce 100755
--- a/.git-hooks/commit-msg
+++ b/.git-hooks/commit-msg
@@ -29,10 +29,19 @@ fi
 # This is not hypothetical, and it happened here. This repo's #274 carried two
 # `chore(ci): ... [skip release]` subjects, so the squashed commit on main was
 # filtered out whole, the crypto fix merged, and no version was ever published.
-if (echo "$subject" | grep -Eq "\[skip (release|ci)\]") then
-   echo "${RED}❌ The commit subject contains [skip release] or [skip ci]!"
+# Mirrors the upstream filters rather than a subset of them:
+#   - semantic-release drops any commit matching
+#     /\[skip\s+release]|\[release\s+skip]/i (lib/definitions/plugins.js), so the
+#     match is case-insensitive and accepts any run of whitespace
+#   - GitHub skips the push or pull_request run entirely for [skip ci],
+#     [ci skip], [no ci], [skip actions] and [actions skip], case-insensitively
+# A narrower pattern let "[SKIP RELEASE]" and "[release skip]" through, and both
+# still suppressed the release.
+if (echo "$subject" | grep -Eqi "\[(skip[[:space:]]+release|release[[:space:]]+skip|skip[[:space:]]+ci|ci[[:space:]]+skip|no[[:space:]]+ci|skip[[:space:]]+actions|actions[[:space:]]+skip)\]") then
+   echo "${RED}❌ The commit subject carries a skip marker!"
    echo "Under squash-merge that suppresses the release for the whole PR, not"
-   echo "just this commit. Drop the marker - a conventional type is enough:"
+   echo "just this commit, and [skip ci] stops the workflow running at all."
+   echo "Drop the marker - a conventional type is enough:"
    echo "  chore(deps): refresh the lockfile"
    exit 1
 fi
diff --git a/release/audit.mjs b/release/audit.mjs
index 061b412..b38a8b2 100644
--- a/release/audit.mjs
+++ b/release/audit.mjs
@@ -52,6 +52,10 @@ const EXEMPT = new Map([
     'GHSA-6j4f-fj2g-mc7p',
     'brace-expansion, inside the npm package that @semantic-release/npm bundles.'
   ],
+  [
+    'GHSA-rj75-hqrm-r3gf',
+    "postcss-selector-parser, inside the npm package that @semantic-release/npm bundles. Affected through 7.1.5. npm ships its own bundled copy, so no resolver change reaches it - 11.21.0 is the last 11.x and @semantic-release/npm requires ^11 - and the eventual fix is that plugin moving to npm 12. Unreachable here: the parser reads this repo's own release config, not the commits being matched."
+  ],
   ['GHSA-rpw4-54j3-4h4q', 'ip-address, inside the npm package that @semantic-release/npm bundles.'],
   ['GHSA-2vr4-cq9g-pvrc', 'ip-address, inside the npm package that @semantic-release/npm bundles.'],
   ['GHSA-j6r3-76f7-8jcv', 'ip-address, inside the npm package that @semantic-release/npm bundles.'],