chore: upgrade postcss to ^8.5.25 to address CVE-2026-69153 (#1543)

* chore: upgrade postcss to ^8.5.25 to address CVE-2026-69153

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: add CHANGELOG entry for postcss upgrade

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: claude[bot] <claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>

Author: 3 people

CHANGELOG.md

@@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Fixed a crash when searching with `context:` referencing a search context that does not exist; it now returns a graceful error. [#1362](https://github.com/sourcebot-dev/sourcebot/pull/1362)
 - Fixed search queries failing to parse when negating a bare term that contains a colon (e.g. `-foo:bar`, `-http://example.com`). [#1301](https://github.com/sourcebot-dev/sourcebot/pull/1301)
 - Fixed the Review Agent failing to fetch pull request diffs for private GitHub repositories. [#1352](https://github.com/sourcebot-dev/sourcebot/pull/1352)
+- Upgraded `postcss` to `^8.5.25`. [#1543](https://github.com/sourcebot-dev/sourcebot/pull/1543)
 - Upgraded `socket.io-parser` to `^4.2.7`. [#1542](https://github.com/sourcebot-dev/sourcebot/pull/1542)
 - Upgraded `fast-uri` to `^3.1.5`. [#1541](https://github.com/sourcebot-dev/sourcebot/pull/1541)
 - Upgraded `ip-address` to `^10.4.0`. [#1540](https://github.com/sourcebot-dev/sourcebot/pull/1540)

yarn.lock

@@ -19680,13 +19680,13 @@ __metadata:
   linkType: hard
 
 "postcss@npm:^8.4.47, postcss@npm:^8.5.12, postcss@npm:^8.5.15":
-  version: 8.5.22
-  resolution: "postcss@npm:8.5.22"
+  version: 8.5.25
+  resolution: "postcss@npm:8.5.25"
   dependencies:
     nanoid: "npm:^3.3.16"
     picocolors: "npm:^1.1.1"
     source-map-js: "npm:^1.2.1"
-  checksum: 10c0/9e143ee457988049d5f187116fd37f2750ae9d8d71cc99eae690b776e549e134b34086cbaa2f0360ecd1729b15d918227bd0fc3a2ffbe341f7212d0827080793
+  checksum: 10c0/0a12c1e74b456c57122e81f684e02fd98ff4d57526f794d10c996df1147158808f5ae373ac82b988c8de6cbbaa82dbd7b13803b14f5dd3cf7cc6a42ccad5c9f2
   languageName: node
   linkType: hard