Fix multiple CVEs by updating postcss to patched version

[sbouchet]

What does this PR do?

This PR fixes CVE-2026-45623 and CVE-2026-69153
postcss version is updated to 8.5.26

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-12201
https://redhat.atlassian.net/browse/CRW-12157

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

• the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
• the corresponding items were added to the CHANGELOG.md file
• rules for automatic git rebase were added to the .rebase folder

Summary by CodeRabbit

• Bug Fixes
  • Updated PostCSS requirements across build tools and extensions to improve compatibility and consistency.
  • Updated the Monaco test environment to use the latest supported PostCSS version.
• Chores
  • Added package configuration safeguards to ensure consistent dependency resolution.
  • Improved handling of package configuration conflicts during rebasing.
  • Added a changelog entry documenting the update.

[github-actions]

Click here to review and test in web IDE:

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8847a87a-2551-466c-8398-2c1ef16ff7eb

📥 Commits

Reviewing files that changed from the base of the PR and between aacfde4 and fec6040.

⛔ Files ignored due to path filters (6)

• code/build/vite/package-lock.json is excluded by !**/package-lock.json
• code/extensions/copilot/chat-lib/package-lock.json is excluded by !**/package-lock.json
• code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json
• code/extensions/mermaid-markdown-features/package-lock.json is excluded by !**/package-lock.json
• code/package-lock.json is excluded by !**/package-lock.json
• code/test/monaco/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (14)

• .rebase/CHANGELOG.md
• .rebase/add/code/build/vite/package.json
• .rebase/add/code/extensions/copilot/chat-lib/package.json
• .rebase/add/code/extensions/copilot/package.json
• .rebase/add/code/extensions/mermaid-markdown-features/package.json
• .rebase/add/code/package.json
• .rebase/override/code/test/monaco/package.json
• code/build/vite/package.json
• code/extensions/copilot/chat-lib/package.json
• code/extensions/copilot/package.json
• code/extensions/mermaid-markdown-features/package.json
• code/package.json
• code/test/monaco/package.json
• rebase.sh

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Package manifests now align PostCSS resolution to ^8.5.26 across Vite, Copilot, Mermaid, sourcemaps, and Monaco test packages. The rebase script adds conflict handling for the Mermaid package manifest. A changelog entry records the affected package files.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to fec60

This PR updates the postcss dependency to address the stated vulnerabilities; no actionable merge-blocking risk remains after normal checks and review.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Rebase Rules For Upstream Changes	❌ Error	All six non-lock code manifests have rules, changelog entries, and routing, but the required CHANGELOG checklist item remains unchecked in the PR description.	Check the CHANGELOG checkbox in the PR template before merging.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, uses imperative mood, and clearly describes the PostCSS security update.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-791-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-791-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-791-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-791-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-791-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-791-dev-amd64