fix: upgrade postcss to 8.5.18 (GHSA-r28c-9q8g-f849)

[anupamme]

Summary

Upgrade postcss from 8.5.3 to 8.5.18 to fix GHSA-r28c-9q8g-f849.

Vulnerability

Field	Value
ID	GHSA-r28c-9q8g-f849
Severity	HIGH
Scanner	trivy
Rule	GHSA-r28c-9q8g-f849
File	packages/vue-router/package-lock.json (dependency: postcss)
Assessment	Present in dependency tree, not confirmed reachable

Description: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Changes

• packages/vue-router/package.json
• packages/vue-router/package-lock.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security

[vercel]

@anupamme is attempting to deploy a commit to the Ionic Team on Vercel.

A member of the Team first needs to authorize it.

[anupamme]

Flagging overlap with #31318, which also touches `packages/vue-router`'s postcss resolution.

This PR targets postcss 8.5.18 (fixes GHSA-r28c-9q8g-f849). However, `main` has since moved to postcss 8.5.14 by default (no override), and there's a further postcss fix in 8.5.23 for the case where `opts.from` is unset. 8.5.18 alone wouldn't cover that.

I've updated #31318 to rebase onto current `main` and pin the override to postcss 8.5.23 (chosen over the latest 8.5.26 since 8.5.24 reportedly introduced a BOM regression for some consumers), with before/after `npm ls postcss` verification in the description.

To avoid landing two overlapping postcss security PRs, would it make sense to consolidate on whichever of these two you'd rather merge? Happy to close #31318 if you'd prefer to bump the target here to 8.5.23 instead, or vice versa.

[thetaPC]

Thanks for the PR! This ended up being handled in #31436, so we're closing this one out. Appreciate you digging into it.

[isabellab7734]

Unsubscribe

…

On Mon, Sep 21, 2026 at 12:25 PM Maria Hutt ***@***.***> wrote: *thetaPC* left a comment (ionic-team/ionic-framework#31317) Thanks for the PR! This ended up being handled in #31436, so we're closing this one out. Appreciate you digging into it. — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>