fix: upgrade postcss to >=8.5.12 to address CVE-2026-45623

[TooTallNate]

Fixes VULN-13433

Summary

Socket.dev flagged postcss@8.5.6 (CVE-2026-45623, CVSS 7.5 High) — arbitrary file read / information disclosure via attacker-controlled sourceMappingURL comments in CSS input. Affected versions are < 8.5.12.

Changes

• workbench/swc-playground/package.json: bump postcss from ^8.5 to ^8.5.12 (the manifest the alert was filed against)
• docs/package.json: bump postcss from ^8.5.6 to ^8.5.12 — this workspace resolved the same vulnerable 8.5.6 in the lockfile
• pnpm-lock.yaml: postcss@8.5.6 is fully removed; both workspaces (and the transitive @tailwindcss/postcss / vite consumers) now resolve postcss@8.5.16

Notes

• No changeset needed: only private, unpublished workspaces (docs, workbench/swc-playground) are affected (pnpm changeset status --since=main passes)
• A transitive postcss@8.4.31 remains in the lockfile (pinned by Next.js internally); it is not addressable via these manifests and is outside the scope of this alert, which targets the direct dependency

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
example-nextjs-workflow-turbopack	Ready	Preview, Comment	Jul 23, 2026 7:47pm
example-nextjs-workflow-webpack	Ready	Preview, Comment	Jul 23, 2026 7:47pm
example-workflow	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workbench-astro-workflow	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workbench-express-workflow	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workbench-fastify-workflow	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workbench-hono-workflow	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workbench-nestjs-workflow	Building	Preview, Comment	Jul 23, 2026 7:47pm
workbench-nitro-workflow	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workbench-nuxt-workflow	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workbench-sveltekit-workflow	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workbench-tanstack-start-workflow	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workbench-vite-workflow	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workflow-docs	Ready	Preview, Comment, Open in v0	Jul 23, 2026 7:47pm
workflow-swc-playground	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workflow-tarballs	Ready	Preview, Comment	Jul 23, 2026 7:47pm
workflow-web	Ready	Preview, Comment	Jul 23, 2026 7:47pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1131de3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🧪 E2E Test Results

❌ Some tests failed

Summary

	Passed	Failed	Skipped	Total
❌ ▲ Vercel Production	1448	7	239	1694
✅ 💻 Local Development	1332	0	208	1540
❌ 📦 Local Production	1620	1	227	1848
✅ 🐘 Local Postgres	1621	0	227	1848
✅ 🪟 Windows	154	0	0	154
❌ 📋 Other	1019	1	212	1232
✅ vercel-multi-region	27	0	0	27
Total	7221	9	1113	8343

❌ Failed Tests

▲ Vercel Production (7 failed)

astro (1 failed):

• instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_41KY88SXFM0GGB9G00WQBCNHZN | 🔍 observability

example (2 failed):

• stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars) | wrun_41KY88Q1ZR0GW68G6PA6EVQ7EA | 🔍 observability
• instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_41KY88SXFM0GGB9G00WQBCNHZN | 🔍 observability

fastify (1 failed):

• instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_41KY88SXFM0GGB9G00WQBCNHZN | 🔍 observability

hono (1 failed):

• error handling retry behavior regular Error retries until success

nextjs-turbopack (1 failed):

• error handling retry behavior regular Error retries until success

vite (1 failed):

• instanceMethodStepWorkflow - instance methods with "use step" directive | wrun_41KY88SXFM0GGB9G00WQBCNHZN | 🔍 observability

📦 Local Production (1 failed)

nextjs-turbopack-canary (1 failed):

• stepWinsRaceWorkflow | wrun_41KY88BSEM0GKB0PHHRYHR1X9E

📋 Other (1 failed)

e2e-vercel-prod-nest (1 failed):

• error handling retry behavior regular Error retries until success

Details by Category

❌ ▲ Vercel Production

App	Passed	Failed	Skipped
❌ astro	125	1	28
❌ example	124	2	28
✅ express	126	0	28
❌ fastify	125	1	28
❌ hono	125	1	28
❌ nextjs-turbopack	150	1	3
✅ nextjs-webpack	151	0	3
✅ nitro	126	0	28
✅ nuxt	126	0	28
✅ sveltekit	145	0	9
❌ vite	125	1	28

✅ 💻 Local Development

App	Passed	Failed	Skipped
✅ astro-stable	128	0	26
✅ express-stable	128	0	26
✅ fastify-stable	128	0	26
✅ hono-stable	128	0	26
✅ nextjs-turbopack-canary	135	0	19
✅ nextjs-turbopack-stable	154	0	0
✅ nitro-stable	128	0	26
✅ nuxt-stable	128	0	26
✅ sveltekit-stable	147	0	7
✅ vite-stable	128	0	26

❌ 📦 Local Production

App	Passed	Failed	Skipped
✅ astro-stable	128	0	26
✅ express-stable	128	0	26
✅ fastify-stable	128	0	26
✅ hono-stable	128	0	26
❌ nextjs-turbopack-canary	134	1	19
✅ nextjs-turbopack-stable	154	0	0
✅ nextjs-webpack-canary	135	0	19
✅ nextjs-webpack-stable	154	0	0
✅ nitro-stable	128	0	26
✅ nuxt-stable	128	0	26
✅ sveltekit-stable	147	0	7
✅ vite-stable	128	0	26

✅ 🐘 Local Postgres

App	Passed	Failed	Skipped
✅ astro-stable	128	0	26
✅ express-stable	128	0	26
✅ fastify-stable	128	0	26
✅ hono-stable	128	0	26
✅ nextjs-turbopack-canary	135	0	19
✅ nextjs-turbopack-stable	154	0	0
✅ nextjs-webpack-canary	135	0	19
✅ nextjs-webpack-stable	154	0	0
✅ nitro-stable	128	0	26
✅ nuxt-stable	128	0	26
✅ sveltekit-stable	147	0	7
✅ vite-stable	128	0	26

✅ 🪟 Windows

App	Passed	Failed	Skipped
✅ nextjs-turbopack	154	0	0

❌ 📋 Other

App	Passed	Failed	Skipped
✅ e2e-local-dev-nest-stable	128	0	26
✅ e2e-local-dev-tanstack-start-	128	0	26
✅ e2e-local-postgres-nest-stable	128	0	26
✅ e2e-local-postgres-tanstack-start-	128	0	26
✅ e2e-local-prod-nest-stable	128	0	26
✅ e2e-local-prod-tanstack-start-	128	0	26
❌ e2e-vercel-prod-nest	125	1	28
✅ e2e-vercel-prod-tanstack-start	126	0	28

✅ vercel-multi-region

App	Passed	Failed	Skipped
✅ nextjs-turbopack	27	0	0

---

📋 View full workflow run

---

❌ Some E2E test jobs failed:

• Vercel Prod: failure
• Local Dev: failure
• Local Prod: failure
• Local Postgres: success
• Windows: success

Check the workflow run for details.

[github-actions]

📊 Workflow Benchmarks

commit 1131de3 · Thu, 23 Jul 2026 19:59:25 GMT · run logs

Backend: vercel · app: nextjs-turbopack

Metric	Scenario	Best (ms)	P75 (ms)	P90 (ms)	P99 (ms)	Samples
TTFS	step	1135 (+363%) 🔻	1274 🔴 (+14%)	1299 🔴 (+13%)	1328 🔴 (-13%)	30
TTFS	stream	1212 (+525%) 🔻	1263 🔴 (+17%) 🔻	1278 🔴 (+15%)	1309 🔴 (+2.4%)	30
TTFS	hook + stream	462 (+28%) 🔻	1510 🔴 (+15%) 🔻	1547 🔴 (+5.9%)	1604 🔴 (-12%)	30
STSO	1020 steps (1-20)	162 (-10%)	269 🔴 (-33%) 💚	303 🔴 (-38%) 💚	501 🔴 (-12%)	19
STSO	1020 steps (101-120)	185 (-7.5%)	255 🔴 (-3.4%)	293 🔴 (-26%) 💚	423 🔴 (-35%) 💚	19
STSO	1020 steps (1001-1020)	455 (-9.4%)	521 🔴 (-10%)	670 🔴 (+6.3%)	3481 🔴 (+440%) 🔻	19
WO	1020 steps	368381 (-14%)	368381 (-14%)	368381 (-14%)	368381 (-14%)	1
SL	stream latency	82 (-6.8%)	126 🔴 (-13%)	137 🔴 (-22%) 💚	152 🔴 (-35%) 💚	30

_{Best/P75/P90/P99 deltas compare against the most recent benchmark run on main at the time of this run. 🔻 flags a delta worse than +15%, 💚 one better than −15%.}

_{Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt)}

_{Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt)}

_{🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · STSO (1-20) 20/30/60 · STSO (101-120) 30/45/90 · STSO (1001-1020) 40/60/120}

_{All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor (clientStart) right before start(), so the CI runner’s request and its path through api.vercel.com sit outside every measured window. TTFS = in-deployment start() → first step body (turbo uses the in-process fast path, non-turbo the dispatch path), and includes the VQS dispatch hop plus any /flow cold start. STSO/WO are measured between step bodies on the deployment. SL is measured inside the workflow (parallel reader/writer steps), so it no longer includes the api.vercel.com read path.}

_{Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the /flow invocation for a large fraction of runs, inflating P75+; the Best column shows the fastest (warm-start) sample for comparison.}

[Copilot]

Pull request overview

This PR updates postcss in private workspaces to remediate CVE-2026-45623 by ensuring direct workspace dependencies no longer allow resolving vulnerable <8.5.12 versions, and refreshes the lockfile to remove postcss@8.5.6.

Changes:

• Bump postcss to ^8.5.12 in workbench/swc-playground and docs.
• Update pnpm-lock.yaml so direct resolutions move to postcss@8.5.16 and postcss@8.5.6 is removed.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
workbench/swc-playground/package.json	Bumps the workspace devDependency postcss floor to a patched version.
docs/package.json	Bumps the workspace devDependency postcss floor to a patched version.
pnpm-lock.yaml	Removes postcss@8.5.6 and updates resolved postcss versions to 8.5.16.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Backport to stable failed for 9216556 due to a workflow error (backport job run).

This is usually an infrastructure problem (e.g. the configured AI model could not be found, an AI Gateway error, or an opencode crash) rather than a merge conflict. Check the job logs linked above for details.

Once the underlying issue is fixed, re-run the Backport to stable workflow manually via workflow_dispatch and paste this commit SHA into the ref input:

9216556bf5505d798b7bef84ebd86739258fe497