Fix Dependabot high-severity alerts (postcss, fast-uri, js-yaml, brace-expansion, nanoid)

[claude]

<!-- ccr-slack-attribution -->
Requested by Joe Ben Clark · Slack thread

What this fixes

Extends the existing package.json overrides block (same pattern already used for loader-utils, lodash, json5, etc.) to pin transitive dependencies to their patched versions, resolving the open Dependabot alerts:

Alert(s)	Package	Advisory	Old	New (override)
#114, #116	postcss	Arbitrary file read / path traversal via sourceMappingURL in CSS comments, ReDoS, XSS via unescaped </style> (multiple stacked advisories, all fixed together)	6.0.23 / 7.0.39 / 8.5.24 (mixed, nested copies)	^8.5.26
#118	fast-uri	Host confusion via backslash authority introducer	3.1.4	^3.1.6
#123, #124	js-yaml	Quadratic CPU consumption in !!omap resolution (CVE-2026-59870), fix not backported to 3.x/4.x until this release	4.3.0 (top-level), 3.15.0 (nested under @istanbuljs/load-nyc-config)	^4.3.1 top-level; ^3.15.1 scoped to the @istanbuljs/load-nyc-config consumer (kept on the 3.x line since that package still uses the v3-only safeLoad/safeDump API removed in v4)

Two additional high-severity npm audit findings that weren't visible in the screenshot (part of the "7 more alerts" not shown) were fixed the same way:

Package	Advisory	Old	New (override)
brace-expansion	DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	2.1.3	^2.1.4
nanoid	Custom generators can loop indefinitely when size is zero	3.3.16	^3.3.18

All of the above are non-breaking patch/minor bumps within their existing major version lines — no major-version jumps were needed for any of these.

Known remaining issue (not fixable right now)

image-size has two open high-severity advisories (GHSA-w3rx-r6r6-pgpr — ICNS parser infinite loop; GHSA-5p2g-fcmc-qvqq — JXL/HEIF parser infinite loops). I bumped the override to ^2.0.2, the latest published version, but confirmed via both advisories that no patched release exists yet upstream ("Patched versions: None"). This also leaves less flagged, purely because less depends on the vulnerable image-size.

Practical risk here is effectively nil: image-size/less are pulled in only through the typescript-plugin-css-modules devDependency (an editor/TS-language-service plugin), and this repo has zero .less files, so the vulnerable code path is never exercised. Will need a follow-up once upstream ships a fix.

Verification

• npm install regenerated package-lock.json cleanly with the new overrides (nested duplicate old postcss 6.x/7.x copies were deduped away entirely).
• npm audit high+critical count: 7 high → 2 high (the 2 remaining are the unfixed image-size/less advisories above; 0 critical before and after).
  • Overall: 32 vulnerabilities (9 low, 16 moderate, 7 high) → 21 vulnerabilities (9 low, 10 moderate, 2 high).
• CI=true npm run build (react-scripts build) completes successfully with no errors.
• npm test was run; the repo currently has no test files (0 matches for testMatch), so there was nothing to execute — not a regression from this change.

🤖 Generated with Claude Code

---

Generated by Claude Code