fix: add postcss override to ^8.5.10 to resolve CVE-2026-41305

[jwfing]

Summary by CodeRabbit

• Chores
  • Updated dependency configurations to ensure build stability.

[coderabbitai]

Walkthrough

The PR adds a postcss version override (^8.5.10) to the package.json overrides section, ensuring a specific compatible version is used across the project dependency tree.

Changes

Dependency Override Update

Layer / File(s)	Summary
Override Configuration package.json	Adds "postcss": "^8.5.10" override between existing lodash and rollup overrides to pin a compatible postcss version.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested reviewers

• Fermionic-Lyu
• tonychang04
• CarmenDou

Poem

🐰 A postcss pin in our package.json home,
One tiny override, so the styles won't roam!
Version eight-point-five now locked in place,
Dependencies march in an orderly race,
One small hop toward stability's grace! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title clearly and specifically describes the main change: adding a postcss override to version ^8.5.10 to address CVE-2026-41305, which directly matches the single-line change in package.json.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/hono-ghsa-458j-xx4x-4375

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

package.json (1)

3-3: ⚡ Quick win

Bump patch version for this bug-fix/security change before release.

Since this PR is a bug fix (security remediation), bumping from 1.2.10 to the next patch version will keep publishing flow aligned and avoid release ambiguity.

Proposed change

-  "version": "1.2.10",
+  "version": "1.2.11",

As per coding guidelines, "Use npm version patch for bug fixes" and "CHECK package.json for current version before bumping the version".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 3, The package.json "version" field is still "1.2.10"
but this PR is a bug-fix/security change; update the version to the next patch
release by running the standard bump (use "npm version patch" to set
package.json's "version" from 1.2.10 to 1.2.11) and commit the resulting change
so the release pipeline and package.json stay synchronized; ensure the "version"
key is updated and verified before merging.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@package.json`:
- Line 3: The package.json "version" field is still "1.2.10" but this PR is a
bug-fix/security change; update the version to the next patch release by running
the standard bump (use "npm version patch" to set package.json's "version" from
1.2.10 to 1.2.11) and commit the resulting change so the release pipeline and
package.json stay synchronized; ensure the "version" key is updated and verified
before merging.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c2d33c99-f1aa-4647-a393-f93e1a09093c

📥 Commits

Reviewing files that changed from the base of the PR and between 3f31727 and 1e3fb95.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json