[HIGH] fix: CVE-2026-45623 — bump postcss

[Pattern Security Automation (pattern-security-automation)]

Supply Chain Vulnerability — Auto-Remediation PR

This PR was automatically generated by Pattern Security Automation.
Please review the dependency change and ensure CI passes before merging.

---

CVE Details

Field	Value
CVE	CVE-2026-45623
Severity	HIGH
Repository	patterninc/esbuild-scss-modules-plugin
Vulnerable package	postcss
Fixed version	8.5.12
Dependency type	Direct
Previous version	^8.3.5
Language	javascript

What Changed

postcss: ^8.3.5 → 8.5.18

• package.json
• package-lock.json

Breaking Change Analysis

Verdict: Compatible — The upgrade from postcss ^8.3.5 to 8.5.18 does not break any existing usage in this codebase. The repository uses postcss in a straightforward way: calling postcss([...plugins]).process(css, { from: scssFullPath, map: false }). The most notable behavioral change in 8.5.18 is a security restriction on loading previous source map files to the opts.from folder, but since the code explicitly sets map: false, no source map loading occurs and this restriction is irrelevant. All other changes in the 8.4.x and 8.5.x series are bug fixes, performance improvements, and additive features that do not affect the API surface used here.

Lock File Status

Lock file updated

CI Validation

This PR relies on the repository's existing CI pipeline to validate that the
dependency update does not break tests. Please ensure all checks pass before merging.

False positive?

If you've reviewed this and the CVE is not actually exploitable here, add the
wiz-false-positive label to this PR before closing it. The auto-remediation
pipeline will record the false positive, stop re-flagging this CVE, and (if enabled)
mark it rejected in Wiz.

AI Triage Analysis

Verdict: True Positive

Reasoning: The repository directly depends on postcss (^8.3.5) as a production dependency in package.json, and both index.ts and index.js explicitly import and call postcss (e.g., import postcss from 'postcss' and postcss_1.default([...]).process(css, {...})). The vulnerable package is actively used in the core plugin logic to process CSS. The pinned version range ^8.3.5 would include versions below the fixed 8.5.12, making this potentially exploitable if the CVE affects the .process() code path.

References

• View in Wiz

Developer feedback

Was this automation helpful? Share feedback (takes ~1 min)

---

Auto-generated by Pattern Security Automation

[Copilot]

Pull request overview

This PR remediates CVE-2026-45623 by upgrading the repository’s direct postcss dependency to a non-vulnerable 8.5.x release line, aligning with the security advisory’s fixed-version guidance.

Changes:

• Bumped postcss from ^8.3.5 to ^8.5.18 in package.json.
• Updated package-lock.json to reflect the resolved postcss@8.5.26 and its updated transitive dependency set.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Updates the direct postcss semver range to ^8.5.18 to ensure versions include the fix.
package-lock.json	Regenerates lock entries to resolve postcss to a patched 8.5.x version and update transitive dependencies accordingly.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.