chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped postcss to 8.5.18 to resolve a high severity path traversal vulnerability in source map auto-loading (alert #70)
• Added an override for brace-expansion to 1.1.16 to fix a high severity DoS via exponential-time expansion, affecting transitive copies pulled in via glob and test-exclude (alert #69)

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#70	postcss	high	Bumped override to 8.5.18
#69	brace-expansion	high	Added override >=1.1.16

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9dad885f-04ed-4dd6-9221-a4b2e07321bc

📥 Commits

Reviewing files that changed from the base of the PR and between 74bf4b2 and 1080e48.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

The package override configuration updates postcss to version 8.5.18 and adds a brace-expansion constraint of >=1.1.16.

Changes

Dependency overrides

Layer / File(s)	Summary
Update dependency override constraints package.json	The postcss override changes from 8.5.14 to 8.5.18. A brace-expansion override requires version 1.1.16 or later.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• open-feature/react-native-test-app#8: Both PRs modify dependency overrides in package.json, including brace-expansion constraints.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes resolving Dependabot security alerts through dependency updates.
Description check	✅ Passed	The description directly explains the two dependency updates and the high-severity security alerts they address.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}