fix(deps): remediate nanoid CVE-2026-67213

[plural-copilot]

Summary

• Remediate CVE-2026-67213 / GHSA-2v37-7h3g-55p8 by upgrading postcss from 8.5.23 to 8.5.28 without a major-version migration.
• The original resolved dependency path was plural-marketing-site -> postcss@8.5.23 -> nanoid@3.3.16; postcss@8.5.28 declares nanoid@^3.3.18, and the regenerated lockfile resolves the only nanoid instance to 3.3.18.

Fixes PROD-5183

Changed files

• package.json — pin the direct parent dependency to postcss@8.5.28.
• package-lock.json — regenerate npm resolution and integrity metadata, updating nanoid from 3.3.16 to 3.3.18.

Validation

• docker run --rm -v "$PWD":/app -w /app node:26-alpine sh -lc 'apk add --no-cache git; rm -rf node_modules .next; npm ci' — passed (the container emitted a non-fatal Husky Git-context message).
• npm ls nanoid --all in that clean install — passed; output was postcss@8.5.28 -> nanoid@3.3.18 only.
• Lockfile enumeration/assertion — passed; every resolved nanoid entry is >= 3.3.18, with no 3.3.16 remaining.
• npm run lint — passed.
• npm run build — passed; emitted a non-fatal existing Turbopack dynamic-trace warning for next.config.ts.

npm ci reported 8 unrelated audit findings; they are outside this narrowly scoped remediation.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Remediate CVE-2026-67213 / GHSA-2v37-7h3g-55p8 in pluralsh/marketing and open exactly one pull request....
🔗 Run history	View run history

[linear]

PROD-5183

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	postcss@​8.5.23 ⏵ 8.5.28	+1		+1	+3

View full report

[greptile-apps]

Greptile Summary

This PR upgrades PostCSS from 8.5.23 to 8.5.28 so its Nanoid dependency resolves to the remediated 3.3.18 release.

• Keeps the dependency update within the existing PostCSS major version.
• Regenerates npm lock metadata consistently with the updated dependency graph.
• Removes the vulnerable Nanoid 3.3.16 resolution from the supported installation and deployment path.

Confidence Score: 5/5

The PR appears safe to merge and fully updates the supported install path to the remediated Nanoid version.

No actionable failures remain: dependency constraints are compatible, the lockfile is internally consistent, and deployment installs the sole Nanoid resolution at 3.3.18.

Important Files Changed

Filename	Overview
package.json	Pins PostCSS 8.5.28, which remains compatible with the repository’s engine and PostCSS plugin requirements.
package-lock.json	Resolves PostCSS 8.5.28 and the sole Nanoid instance at 3.3.18 with internally consistent npm lock metadata.

_{Reviews (1): Last reviewed commit: "fix(deps): upgrade postcss to remediate ..." | Re-trigger Greptile}