chore: upgrade postcss to >= 8.5.19 [Lightpseed] [release-1.10]

[Omar-AlJaljuli]

Hey, I just made a Pull Request!

PostCSS is vulnerable due to CVE-2026-69153. Fix by upgrading to a patched version of PostCSS (>8.5.19). This does not affect the plugins, but upgrading because of the SBOM.

Fix done using simple 'yarn up -R ...'

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

PR Summary by Qodo

Upgrade PostCSS in Lightspeed lockfile to patched 8.5.x

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Upgrade PostCSS to a patched release to address CVE-2026-69153.
• Refresh Lightspeed workspace lockfile via yarn upgrade, updating transitive deps.
• Bump nanoid to the compatible patched minor required by PostCSS 8.5.x.

Diagram

graph TD
  Dev["Lightspeed build"] --> Install["Yarn install"] --> Lock["workspaces/lightspeed/yarn.lock"] --> PostCSS["postcss@8.5.26"] --> Patched["CVE patched"]
  PostCSS --> Nanoid["nanoid@3.3.18"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Add a Yarn resolution/override for PostCSS

• ➕ Forces patched PostCSS across all transitive paths, even without regenerating the full lockfile
• ➕ Can be a quicker mitigation if upgrade churn is undesirable
• ➖ Can mask incompatible upstream constraints
• ➖ Adds ongoing maintenance/cleanup work once upstream packages catch up

2. Upgrade the direct dependency that brings in PostCSS

• ➕ Keeps dependency graph consistent with upstream expectations
• ➕ May pull in other security fixes and tooling improvements
• ➖ Potentially much larger diff and higher regression risk than a targeted PostCSS bump
• ➖ May require code/config adjustments if the upstream package has breaking changes

3. Automate with Dependabot/Renovate for security-only bumps

• ➕ Reduces manual effort and improves time-to-patch for future CVEs
• ➕ Standardizes dependency update workflow
• ➖ Doesn’t immediately solve this CVE unless already configured and running
• ➖ Can increase PR volume without careful grouping rules

Recommendation: The current approach (lockfile upgrade to a patched PostCSS) is the most pragmatic mitigation: minimal surface area and aligns with SBOM/security scanning needs. Consider adding a temporary workspace-level resolution only if future scans show PostCSS remains reachable via other dependency paths not covered by this lockfile update.

Files changed (1) +8 / -8

Other (1) +8 / -8

yarn.lockResolve PostCSS to 8.5.26 and update transitive nanoid +8/-8

Resolve PostCSS to 8.5.26 and update transitive nanoid

• Updates the resolved PostCSS package from 8.4.49 to 8.5.26 to pick up the security patch for CVE-2026-69153. Adjusts PostCSS’s dependency on nanoid and updates nanoid to 3.3.18 accordingly, with lockfile checksums refreshed.

workspaces/lightspeed/yarn.lock

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. PostCSS upgrade incomplete 🐞 Bug ⛨ Security

Description

The PR upgrades PostCSS only in workspaces/lightspeed/yarn.lock, but the repo root yarn.lock
(and other workspaces) still resolve PostCSS to 8.4.x, so a Lightspeed install can still bring in
the older PostCSS via its root postinstall install. This makes the dependency upgrade inconsistent
and may leave the original risk/scan finding unresolved.

Code

workspaces/lightspeed/yarn.lock[R30762-30765]

+  version: 8.5.26
+  resolution: "postcss@npm:8.5.26"
  dependencies:
-    nanoid: "npm:^3.3.7"
+    nanoid: "npm:^3.3.17"

Relevance

●●● Strong

Team usually accepts lockfile alignment/dedupe updates to fully resolve dependency bumps and
CI/security drift.

PR-#2547
PR-#4000
PR-#3966

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Lightspeed runs a root yarn install in postinstall, which will install dependencies from the
root yarn.lock. The root yarn.lock still resolves postcss@npm:^8.1.0, postcss@npm:^8.4.33 to
8.4.38, and the root dependency graph (e.g. @backstage/cli) explicitly depends on PostCSS,
demonstrating that the older PostCSS is still part of the install graph despite the Lightspeed
lockfile bump.

workspaces/lightspeed/package.json[8-37]
yarn.lock[1731-1762]
yarn.lock[13988-13996]
workspaces/extensions/yarn.lock[29717-29724]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR updates PostCSS only for the Lightspeed workspace lockfile, but the repo root lockfile (and at least one other workspace lockfile) still pins PostCSS 8.4.x. Because `workspaces/lightspeed/package.json` runs a root `yarn install` during `postinstall`, installing Lightspeed can still install the older PostCSS from the root lockfile.

## Issue Context
- Lightspeed workspace triggers a root install during `postinstall`.
- Root lockfile still contains PostCSS 8.4.38, and root dependencies (e.g. `@backstage/cli`) pull PostCSS, so the root install is not a no-op.
- Other workspaces also still pin PostCSS 8.4.x (example: `workspaces/extensions/yarn.lock`).

## Fix Focus Areas
- workspaces/lightspeed/package.json[34-37]
- yarn.lock[1731-1762]
- yarn.lock[13988-13996]
- workspaces/extensions/yarn.lock[29717-29724]

## What to change
1. Update the **root** lockfile to a PostCSS version consistent with the intended patched version (run from repo root):
  - `yarn up -R postcss`
  - commit the resulting `yarn.lock` changes.
2. Update any other workspace lockfiles that still resolve PostCSS to 8.4.x (or otherwise below the intended patched version), e.g.:
  - `cd workspaces/extensions && yarn up -R postcss`
  - repeat for other affected workspaces, commit their `yarn.lock` updates.
3. Re-run installs with `--immutable` to ensure all lockfiles are consistent and CI clean-workdir checks pass.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

✅ Compliance rules (platform): 14 rules

✅ Cross-repo context

  Not relevant to this PR: redhat-developer/rhdh

  Not relevant to this PR: redhat-developer/rhdh-chart

  Not relevant to this PR: redhat-developer/rhdh-operator

  Not relevant to this PR: redhat-developer/rhdh-local

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (lightspeed/release-1.10@fce5805). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                    Coverage Diff                     @@
##             lightspeed/release-1.10    #4237   +/-   ##
==========================================================
  Coverage                           ?   60.96%           
==========================================================
  Files                              ?     2098           
  Lines                              ?    65167           
  Branches                           ?    16940           
==========================================================
  Hits                               ?    39726           
  Misses                             ?    25219           
  Partials                           ?      222           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.58% <ø> (?)		Carriedforward from 230b90c
ai-integrations	70.03% <ø> (?)		Carriedforward from 230b90c
app-defaults	69.60% <ø> (?)		Carriedforward from 230b90c
augment	69.36% <ø> (?)		Carriedforward from 230b90c
bulk-import	72.86% <ø> (?)		Carriedforward from 230b90c
cost-management	16.49% <ø> (?)		Carriedforward from 230b90c
dcm	32.85% <ø> (?)		Carriedforward from 230b90c
extensions	61.79% <ø> (?)		Carriedforward from 230b90c
global-floating-action-button	74.30% <ø> (?)		Carriedforward from 230b90c
global-header	61.68% <ø> (?)		Carriedforward from 230b90c
homepage	50.95% <ø> (?)		Carriedforward from 230b90c
konflux	91.01% <ø> (?)		Carriedforward from 230b90c
lightspeed	68.13% <ø> (?)
mcp-integrations	81.59% <ø> (?)		Carriedforward from 230b90c
orchestrator	36.36% <ø> (?)		Carriedforward from 230b90c
quickstart	62.88% <ø> (?)		Carriedforward from 230b90c
sandbox	79.56% <ø> (?)		Carriedforward from 230b90c
scorecard	83.58% <ø> (?)		Carriedforward from 230b90c
theme	64.54% <ø> (?)		Carriedforward from 230b90c
translations	8.49% <ø> (?)		Carriedforward from 230b90c
x2a	78.28% <ø> (?)		Carriedforward from 230b90c

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fce5805...0d675c8. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.