chore: upgrade postcss to >= 8.5.19 [orchestrator] [release-1.10]

[Omar-AlJaljuli]

Hey, I just made a Pull Request!

PostCSS is vulnerable due to CVE-2026-69153. Fix by upgrading to a patched version of PostCSS (>8.5.19). This does not affect the plugins, but upgrading because of the SBOM.

Fix done using simple 'yarn up -R ...'

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[rhdh-qodo-merge]

PR Summary by Qodo

Upgrade PostCSS to 8.5.26 in orchestrator workspace (CVE-2026-69153)

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Bump PostCSS to 8.5.26 to remediate CVE-2026-69153 in the SBOM.
• Update transitive nanoid resolution to match PostCSS’s updated dependency range.
• Apply dependency changes via yarn.lock update (no source/plugin code changes).

Diagram

graph TD
  A["Orchestrator workspace"] --> B[/"workspaces/orchestrator/yarn.lock"/] --> C(("PostCSS 8.5.26")) --> D(("nanoid 3.3.18"))
  E{{"CVE/SBOM scan"}} --> C

  subgraph Legend
    direction LR
    _svc["Workspace"] ~~~ _file[/"Lockfile"/] ~~~ _dep(("Dependency")) ~~~ _ext{{"External"}}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use yarn resolutions/overrides to force PostCSS version

• ➕ Can fix the vulnerability without regenerating broader parts of the lockfile
• ➕ Useful if some packages have tight/incorrect peer ranges
• ➖ Can mask real incompatibilities and make upgrades harder later
• ➖ Less transparent than a normal upgrade path

2. Adopt automated dependency PRs (Renovate/Dependabot) with security rules

• ➕ Reduces time-to-fix for future CVEs
• ➕ Standardizes upgrade cadence and review process
• ➖ Requires ongoing configuration and triage
• ➖ May increase PR volume/noise without good grouping rules

3. Apply a temporary patch-package/vendor patch (last resort)

• ➕ Unblocks remediation if no patched release exists
• ➕ Can be scoped to exactly the vulnerable code path
• ➖ Maintenance burden; patch can break on future upgrades
• ➖ Not ideal for widely used libraries with available patched releases

Recommendation: The PR’s approach (upgrade to a patched PostCSS release and let yarn resolve updated transitive deps) is the best default: it directly remediates the CVE with minimal maintenance overhead. Resolutions/patching are reasonable contingency options but add long-term complexity compared to a straightforward upgrade.

Files changed (1) +8 / -8

Other (1) +8 / -8

yarn.lockPin PostCSS 8.5.26 and update transitive nanoid resolution +8/-8

Pin PostCSS 8.5.26 and update transitive nanoid resolution

• Updates the lockfile to resolve PostCSS from 8.4.49 to 8.5.26 (patched for CVE-2026-69153). Also updates the nanoid range/resolution used by PostCSS from ^3.3.7/3.3.8 to ^3.3.17/3.3.18, including checksum changes.

workspaces/orchestrator/yarn.lock

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.57%. Comparing base (0f6f9df) to head (5470289).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                    Coverage Diff                     @@
##           orchestrator/release-1.10    #4238   +/-   ##
==========================================================
  Coverage                      59.57%   59.57%           
==========================================================
  Files                           2097     2097           
  Lines                          65234    65234           
  Branches                       16986    17001   +15     
==========================================================
  Hits                           38862    38862           
- Misses                         25977    25980    +3     
+ Partials                         395      392    -3     

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.58% <ø> (ø)		Carriedforward from 0f6f9df
ai-integrations	70.03% <ø> (ø)		Carriedforward from 0f6f9df
app-defaults	69.60% <ø> (ø)		Carriedforward from 0f6f9df
augment	69.36% <ø> (ø)		Carriedforward from 0f6f9df
bulk-import	72.86% <ø> (ø)		Carriedforward from 0f6f9df
cost-management	16.49% <ø> (ø)		Carriedforward from 0f6f9df
dcm	32.85% <ø> (ø)		Carriedforward from 0f6f9df
extensions	61.79% <ø> (ø)		Carriedforward from 0f6f9df
global-floating-action-button	74.30% <ø> (ø)		Carriedforward from 0f6f9df
global-header	61.68% <ø> (ø)		Carriedforward from 0f6f9df
homepage	50.95% <ø> (ø)		Carriedforward from 0f6f9df
konflux	91.01% <ø> (ø)		Carriedforward from 0f6f9df
lightspeed	68.34% <ø> (ø)		Carriedforward from 0f6f9df
mcp-integrations	81.59% <ø> (ø)		Carriedforward from 0f6f9df
orchestrator	37.54% <ø> (ø)
quickstart	62.64% <ø> (ø)		Carriedforward from 0f6f9df
sandbox	79.56% <ø> (ø)		Carriedforward from 0f6f9df
scorecard	83.58% <ø> (ø)		Carriedforward from 0f6f9df
theme	64.54% <ø> (ø)		Carriedforward from 0f6f9df
translations	8.49% <ø> (ø)		Carriedforward from 0f6f9df
x2a	57.33% <ø> (ø)		Carriedforward from 0f6f9df

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0f6f9df...5470289. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.