chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 4 open Dependabot security alerts by bumping vulnerable dependencies

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#122	fast-uri	high	Bumped existing overrides entry from >=3.1.4 <4 to >=3.1.5 <4 (patched)
#120	postcss	high	Bumped direct dependency to ^8.5.18 (patched); existing $postcss override propagates the fix to nested resolutions
#119	js-yaml	high	Bumped existing overrides entry from ^4.1.1 to ^4.3.0
#118	brace-expansion	high	Added new overrides entry >=1.1.16 <2 (transitive dependency, only the 1.x line is in use)

npm test and npm run build pass on the updated lockfile.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ae14c224-f640-427c-aef8-772a102b1a26

📥 Commits

Reviewing files that changed from the base of the PR and between 6322f81 and 4e3dcf2.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

The pull request updates the postcss, js-yaml, and fast-uri dependency constraints in package.json.

Changes

Dependency updates

Layer / File(s)	Summary
Update dependency constraints package.json	Updates postcss to ^8.5.18, js-yaml to ^4.3.0, and the minimum fast-uri version to 3.1.5. Other dependency entries remain unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• open-feature/toggle-shop#40: Updates the same dependencies in package.json.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the dependency updates made to resolve Dependabot security alerts.
Description check	✅ Passed	The description directly explains the four dependency updates and the associated security alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates vulnerable npm dependencies to resolve three high-severity Dependabot alerts.

Changes:

• Updates postcss and js-yaml.
• Overrides vulnerable brace-expansion 1.x versions.
• Regenerates the lockfile with patched transitive dependencies.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Defines patched dependency constraints and overrides.
package-lock.json	Locks patched dependency resolutions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.