fix: upgrade postcss to 8.5.12 (CVE-2026-45623)

[anupamme]

Summary

Upgrade postcss from 8.4.31 to 8.5.12 to fix CVE-2026-45623.

Vulnerability

Field	Value
ID	CVE-2026-45623
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-45623
File	pnpm-lock.yaml
Assessment	Likely exploitable

Description: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

Evidence

Scanner confirmation: trivy rule CVE-2026-45623 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• package.json
• pnpm-lock.yaml

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 896a4d65-0940-4738-9e8c-1fc75a326710

📥 Commits

Reviewing files that changed from the base of the PR and between 4c12866 and 7d84738.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

---

Walkthrough

Updated the devDependencies.postcss entry in package.json from the catalog: placeholder to the explicitly pinned version 8.5.12.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: upgrading PostCSS to 8.5.12 for CVE-2026-45623.
Description check	✅ Passed	The description is directly related to the dependency upgrade and security fix described in the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

PostCSS bypasses workspace catalog

The exact 8.5.12 pin bypasses the catalog-managed ^8.5.16 version, so root build tooling uses an older PostCSS release and future catalog updates will not update this dependency.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Confidence Score: 4/5

The PR is safe to merge from a runtime perspective, but the isolated downgrade should be replaced with the existing catalog-managed newer version.

The lockfile remains internally consistent and shipped packages already resolve PostCSS 8.5.16, but the root dependency now unnecessarily bypasses centralized version management and uses an older release.

Files Needing Attention: package.json, pnpm-lock.yaml

_{Reviews (1): Last reviewed commit: "fix: CVE-2026-45623 security vulnerabili..." | Re-trigger Greptile}

[RobinMalfait]

As mentioned before: #20360 (comment)