fix(security): update vulnerable postcss dependency

[anupamme]

Summary

Remediates a vulnerable transitive postcss dependency used by packages/vue-router.

main currently resolves postcss to 8.5.14 incidentally (no override in place), which does not include:

• the source-map path-restriction fix shipped in 8.5.18 (GHSA-r28c-9q8g-f849 — see fix: upgrade postcss to 8.5.18 (GHSA-r28c-9q8g-f849) #31317)
• the opts.from-unset fix shipped in 8.5.23

This PR adds an npm override so packages/vue-router resolves postcss to 8.5.23, which includes both of the above fixes. 8.5.23 is used as the floor rather than the latest 8.5.26 because 8.5.24 reportedly introduced a BOM regression for some consumers, making 8.5.23 the more conservative, defensible target.

Why

The affected PostCSS versions can process attacker-controlled sourceMappingURL annotations in CSS in a way that may disclose local .map files outside the expected directory, including when opts.from is unset.

This PR is intentionally limited to dependency remediation; it does not change Ionic's application-level CSS processing behavior.

Verification

Before:

$ npm ls postcss --all
@ionic/vue-router@9.0.1
└─┬ vue-router@5.2.0
  └─┬ @vue/compiler-sfc@3.5.34
    └── postcss@8.5.14

After:

$ npm ls postcss --all
@ionic/vue-router@9.0.1
└─┬ vue-router@5.2.0
  └─┬ @vue/compiler-sfc@3.5.34
    └── postcss@8.5.23 overridden

Also confirmed via npm audit that the postcss-related advisories are cleared (the 2 remaining high-severity findings, brace-expansion and js-yaml, are unrelated to this change and out of scope).

Scope

• Update the postcss resolution in packages/vue-router/package.json via npm's existing overrides mechanism.
• Regenerate packages/vue-router/package-lock.json via npm install (no manual edits).
• No application/runtime code changes.
• Branch rebased onto current main (this PR was originally opened against a much older base).

Note on overlap with #31317

#31317 targets postcss@8.5.18 for the same package boundary (GHSA-r28c-9q8g-f849). Since 8.5.18 doesn't include the 8.5.23 opts.from fix, I'd suggest consolidating: either fold that PR's findings into this one, or close this one in favor of #31317 after bumping its target to 8.5.23. Happy to close this PR if maintainers prefer to land the fix there instead — just flagging so we don't end up with two overlapping postcss security PRs.

[vercel]

@anupamme is attempting to deploy a commit to the Ionic Team on Vercel.

A member of the Team first needs to authorize it.

[Benziza]

I think PR can be closed because the current main branch already uses PostCSS 8.5.14, which fixes CVE-2026-45623.

[anupamme]

@Benziza You're right that `main` no longer has the original CVE-2026-45623 issue — it's already at postcss 8.5.14, which is past the 8.5.12 fix. However, 8.5.14 is still below 8.5.18 (source-map path-restriction fix, GHSA-r28c-9q8g-f849, see #31317) and below 8.5.23 (fixes the case where `opts.from` is unset). Neither of those later fixes is covered yet, and there's no explicit override pinning the version, so a future lockfile regen could regress it.

I've rebased this PR onto current `main` and updated it to override postcss to 8.5.23 instead, which covers the remaining known issues. Updated the PR description with before/after `npm ls postcss` evidence. Given the overlap with #31317 (which targets 8.5.18), I've also left a note there — happy to consolidate however maintainers prefer rather than land two overlapping postcss fixes.

[thetaPC]

Thanks for the PR! This ended up being handled in #31436, so we're closing this one out. Appreciate you digging into it.