chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 4 open Dependabot security alerts by scoping npm overrides to the specific dependency paths pulling in vulnerable versions.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#68	shell-quote (<= 1.8.4)	high	Override bumped from ^1.8.4 to ^1.9.0
#67	brace-expansion (>= 3.0.0, < 5.0.7, via @expo/fingerprint -> minimatch@10.2.5)	high	Scoped override to ^5.0.7 for that path only
#66	js-yaml (< 3.15.0, via @istanbuljs/load-nyc-config -> babel-plugin-istanbul -> babel-jest -> react-native)	medium	Overridden to ^3.15.0
#65	js-yaml (>= 4.0.0, <= 4.1.1, via @expo/xcpretty -> @expo/cli -> expo)	medium	Overridden to ^4.2.0

The brace-expansion override is scoped to the @expo/fingerprint -> minimatch path only, since other minimatch@3.x consumers (via babel-plugin-istanbul/glob) resolve brace-expansion@1.1.14, which is outside the vulnerable range (>= 3.0.0) and unaffected by this advisory.

This repo has no test/lint/build scripts and no CI workflows; npm install confirms all four packages resolve to patched versions, and npx tsc --noEmit passes with no errors.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 86b45b1e-f3b2-489e-b189-b6fa324d9fdb

📥 Commits

Reviewing files that changed from the base of the PR and between d51937b and 528a0a8.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

package.json updates the overrides section by bumping shell-quote and adding targeted nested constraints for js-yaml, minimatch, and brace-expansion.

Changes

Dependency override updates

Layer / File(s)	Summary
Update dependency override rules package.json	The override configuration changes shell-quote to ^1.9.0 and adds nested constraints for js-yaml, minimatch, and brace-expansion.

Estimated code review effort: 2 (Simple) | ~10 minutes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR addresses Dependabot-reported security vulnerabilities in transitive js-yaml dependencies by adding targeted npm overrides, ensuring patched js-yaml versions are selected without broadly upgrading parent toolchain packages.

Changes:

• Added scoped npm overrides to force patched js-yaml versions for @istanbuljs/load-nyc-config and @expo/xcpretty.
• Updated package-lock.json to reflect resolved patched versions (js-yaml@3.15.0 and js-yaml@4.3.0).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds scoped overrides to pin vulnerable transitive js-yaml paths to patched ranges.
package-lock.json	Updates the lockfile to reflect the patched js-yaml resolutions (3.15.0 and 4.3.0).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.