fix: bump postcss to 8.5.12 (CVE-2026-45623)

[cwood-11]

Security fix: CVE-2026-45623

Bumps postcss to 8.5.12 to resolve CVE-2026-45623. This closes 44 Wiz-tracked issue(s).

Rationale for this fix: Step 2 (scoped to REPOSITORY_BRANCH/CODE assets, status=OPEN, has_fix=true, ordered by RESOURCE_COUNT desc) ranked GHSA-r28c-9q8g-f849 first (46 findings) but that is excluded per the in-progress list. Among remaining candidates, CVE-2026-45623 (postcss arbitrary file read via sourceMappingURL, HIGH 7.5) ranked #1 with 44 findings across 16 distinct GitHub repos/branches, ahead of CVE-2026-41305 (41 findings, also postcss but a different XSS bug) and a cluster of Next.js CVE-2026-646xx issues (30 findings/13 assets each). Effort assessment: CVE-2026-45623 is LOW effort — every one of the 44 findings names the exact same single package (postcss) and the exact same single fixed version (8.5.12) both in the catalog record and in every individual finding, with no conflicting or ambiguous fix targets. By contrast CVE-2026-41305's findings showed inconsistent/ambiguous fixedVersion values (8.5.10 for some, a 'next@16.3.0-canary.6' value for transitive findings, and null for at least one finding), making it a messier, higher-effort fix to reconcile; the Next.js CVE-2026-646xx cluster would each only need a minor Next.js bump too but affects fewer resources (30 vs 44) and splitting effort across three separate CVEs is less efficient than one consolidated postcss bump. Because CVE-2026-45623 is simultaneously the highest-impact non-excluded candidate (44 findings/16 repos) AND clearly LOW-effort (single package, single semver-patch fix version, satisfiable via a direct/override dependency bump with no breaking API changes noted in the advisory), there is no impact-vs-effort tradeoff to make, so it is selected outright per the guidance to not sacrifice impact when effort is already low. Ecosystem is npm (JavaScript/Node package manager), consistent with Wiz's own classification (npm GitHub Advisory feed, package-lock.json/pnpm-lock.yaml/package.json manifests observed in findings).

Patch stage results

• Test command used: npm install && npm ls postcss (to confirm resolved version) && npm run build (next build) — run in each of the 11 affected example dirs (templates/nextjs, text-to-speech/nextjs/quickstart/example, agents/nextjs/quickstart/example, agents/nextjs/guardrails/example, sound-effects/nextjs/quickstart/example, voice-changer/nextjs/quickstart/example, speech-engine/nextjs/quickstart/example, dubbing/nextjs/quickstart/example, music/nextjs/quickstart/example, voice-isolator/nextjs/quickstart/example, speech-to-text/nextjs/realtime/example)
• Build passed: True
• Tests passed: True
• Vulnerability resolved: True
• Major version bump: False
• Notes: This is a monorepo of independent example apps with no per-example lockfiles committed (root .gitignore explicitly ignores nested package-lock.json files, only the root one is tracked). postcss is not a direct dependency anywhere; it's pulled in transitively (pinned to exact version 8.4.31) by 'next' (and re-required by @tailwindcss/postcss and shadcn) across the 11 Next.js example package.json manifests. Since there's no lockfile to bump and hand-editing a lockfile is disallowed, I used the proper npm tooling npm pkg set overrides.postcss=8.5.12 on each of the 11 affected package.json files to force npm's dependency resolver to pin the transitive postcss to the fixed version (npm's standard mechanism for pinning a transitive dependency). For each example I then ran npm install and verified via npm ls postcss that the resolved/overridden version is 8.5.12 everywhere (previously 8.4.31), and ran npm run build (next build) in every one of the 11 examples — all built successfully with Turbopack, confirming no regression. There is no repo-wide CI test suite for these examples (the only CI workflow, .github/workflows/lint.yml, just runs ruff and prettier checks against the repo root, not per-example builds/tests), so next build per example was the most meaningful functional verification available, and I applied it to every affected example rather than just one. Generated node_modules/, package-lock.json, and .next build artifacts were removed after verification since they are gitignored in this repo and should not be committed. The final diff touches only the 11 package.json files, each adding an overrides.postcss = "8.5.12" entry (npm's package.json writer also reflowed a few pre-existing dependency keys alphabetically in some files as a harmless side effect of using npm pkg set, with no semantic change). 8.5.12 is a patch-level bump within the postcss 8.x line, so this is not a major/breaking version bump.

Independent verification results

• Regressions found: False
• Confidence: medium
• Recommendation: proceed
• Findings:
• Patch applies cleanly to a fresh checkout (git apply --check and git apply both exit 0).
• Diff scope confirmed minimal: only the 11 Next.js package.json files change; no source/config files touched. Intra-file dependency reorderings are alphabetical (side effect of npm pkg set) and semantically neutral.
• All 11 manifests now contain overrides.postcss = "8.5.12"; postcss is transitive everywhere (no direct dependency/devDependency on postcss in any manifest).
• Independently installed templates/nextjs: npm ls postcss shows postcss@8.5.12 'overridden' and node_modules/postcss is version 8.5.12 (>= fixed 8.5.12). npm run build (next build 16.1.6, Turbopack) succeeded.
• Independently installed agents/nextjs/quickstart/example (which also has a coexisting pnpm.overrides block): resolved postcss@8.5.12 and npm run build succeeded, confirming npm still honors the top-level overrides alongside pnpm.overrides.
• CI concern checked: the only CI workflow runs npx prettier . --check. Ran prettier@3.8.1 --check on all changed files -> 'All matched files use Prettier code style', so the JSON edits do not break the prettier CI gate.
• Only 2 of 11 examples were built end-to-end (chosen to cover both the plain pattern and the pnpm.overrides-coexisting pattern); the remaining 9 use the identical override mechanism and were not individually built.
• Caveat (not a regression under current toolchain): 3 examples (agents/guardrails, agents/quickstart, speech-engine) declare pnpm.overrides. The fix uses npm-style overrides; a pnpm-based install of those would not pin postcss. No committed per-example lockfiles exist and CI uses npm, so the fix is effective for the actual toolchain.

---

🤖 Opened automatically by the CVE patch orchestrator. This PR is a draft pending human review — it will not be marked ready for review automatically.