#9022 Refactor: PostCSS line return parsing error

[Copilot]

How the feature works? / How did you fix the issue?

• Problem: Vulnerable PostCSS versions mishandle carriage-return-delimited comments, letting commented content leak into parsed CSS.
• Dependency bump: Pin postcss to 8.5.6 via devDependency and override to ensure all workspaces resolve a safe version.
• Lock refresh: Regenerated lockfile entries to align with the upgraded PostCSS resolution.

Example change:

{
  "devDependencies": {
    "postcss": "^8.5.6"
  },
  "overrides": {
    "nth-check": "^2.1.1",
    "postcss": "^8.5.6"
  }
}

Check list

• unit-tests written
• e2e-tests written
• documentation updated
• PR name follows the pattern #1234 – issue name
• branch name doesn't contain '#'
• PR is linked with the issue
• base branch (master or release/xx) is correct
• task status changed to "Code review"
• reviewers are notified about the pull request

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Refactor: PostCSS line return parsing error</issue_title>
<issue_description>An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.

This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.

Solution: Update postcss package to latest version</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Refactor: PostCSS line return parsing error #9022

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.