fix(agentex-ui): bump postcss to >=8.5.10 (CVE-2026-41305)

[scale-prodsec]

Summary

Remediates CVE-2026-41305 (MEDIUM) — PostCSS XSS via improper escaping of style closing tags (GHSA-qx2v-qp2m-jg93).

postcss is a transitive dependency of agentex-ui/, present at two vulnerable versions in the built image (golden/agentex-ui):

Location	Before	Pulled in by
node_modules/postcss	8.5.6	tailwindcss v4 / @tailwindcss/postcss
node_modules/next/node_modules/postcss	8.4.31	next 15.5.18 (exact pin)

Both are < 8.5.10 (the fixed version), so a single override past the fix clears both.

Change

• agentex-ui/package.json: add "postcss": "^8.5.10" to the existing overrides block (the idiomatic npm mechanism for forcing a transitive dep; the repo already overrides cross-spawn and tar the same way).
• agentex-ui/package-lock.json: regenerated with npm install --package-lock-only. npm dedupes to a single hoisted postcss 8.5.19 (latest 8.5.x, satisfies ^8.5.10); the nested next/node_modules/postcss 8.4.31 copy is removed. Net lockfile change is a removal (9 insertions / 34 deletions).

Safety

Bumping postcss from 8.4.31/8.5.6 to 8.5.x is a minor bump within major 8 (no major boundary crossed); PostCSS maintains backward compatibility within a major, and next 15.5.x already runs against postcss 8.5.x (the top-level copy was 8.5.6). The override only supersedes next's exact 8.4.31 pin, which is a reproducibility pin rather than a compatibility ceiling.

Verification

• npm ci --dry-run resolves cleanly (717 packages, no lockfile-sync error) — matches the Dockerfile build gate (npm ci).
• Re-running the relock is idempotent (lockfile stable).
• No remaining postcss < 8.5.10 anywhere in the lockfile.

Resolves GFDVR-17703 (children GFDVR-17706 postcss@8.4.31, GFDVR-17707 postcss@8.5.6).

Greptile Summary

This PR remediates CVE-2026-41305, a MEDIUM-severity PostCSS XSS vulnerability (GHSA-qx2v-qp2m-jg93), by forcing the transitive postcss dependency to >=8.5.10 via npm's overrides mechanism in agentex-ui/package.json.

• package.json: Adds "postcss": "^8.5.10" to the existing overrides block — the same pattern already used for cross-spawn and tar.
• package-lock.json: npm deduplicates to a single hoisted postcss@8.5.19, removing the previously nested next/node_modules/postcss@8.4.31 copy and bumping the top-level copy from 8.5.6 to 8.5.19; nanoid is also incidentally bumped from 3.3.11 to 3.3.16 as a transitive side-effect of postcss's updated peer requirements.

Confidence Score: 5/5

Safe to merge — a focused transitive dependency override that removes two vulnerable PostCSS copies and deduplicates to a single patched version with no functional code changes.

The change is minimal and mechanical: one line added to the overrides block in package.json, and the lockfile reflects exactly the expected deduplication (nested next/postcss copy gone, top-level hoisted to 8.5.19). The bump stays within major version 8 and is consistent with how next already ran against 8.5.x at the top level. No application code is touched.

No files require special attention.

Important Files Changed

Filename	Overview
agentex-ui/package.json	Adds "postcss": "^8.5.10" override; follows the established pattern for cross-spawn and tar overrides. Minimal and correct.
agentex-ui/package-lock.json	Lockfile regenerated cleanly: nested next/node_modules/postcss@8.4.31 removed, top-level bumped to 8.5.19, nanoid bumped to 3.3.16 as a transitive side-effect. Net change is a simplification (fewer lines).

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["agentex-ui/package.json\noverrides: postcss ^8.5.10"] --> B["npm install"]
    B --> C{"npm deduplication"}
    C -->|"Before - vulnerable"| D["postcss@8.5.6\ntailwindcss path"]
    C -->|"Before - vulnerable"| E["next/postcss@8.4.31\nnested copy"]
    C -->|"After - fixed"| F["postcss@8.5.19\nsingle hoisted copy"]
    D --> X["XSS Risk\nCVE-2026-41305"]
    E --> X
    F --> Y["Fixed - no more vulnerable copies"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["agentex-ui/package.json\noverrides: postcss ^8.5.10"] --> B["npm install"]
    B --> C{"npm deduplication"}
    C -->|"Before - vulnerable"| D["postcss@8.5.6\ntailwindcss path"]
    C -->|"Before - vulnerable"| E["next/postcss@8.4.31\nnested copy"]
    C -->|"After - fixed"| F["postcss@8.5.19\nsingle hoisted copy"]
    D --> X["XSS Risk\nCVE-2026-41305"]
    E --> X
    F --> Y["Fixed - no more vulnerable copies"]

Loading

_{Reviews (2): Last reviewed commit: "Merge main into prodsec/gfdvr-17703-post..." | Re-trigger Greptile}