Update package-lock.json via npm audit fix as security update

[PeterDaveHello]

Dependency lockfile changes:

• brace-expansion from 1.1.14 to 1.1.16, 2.1.0 to 2.1.2, and 5.0.6 to 5.0.8
• fast-uri from 3.1.2 to 3.1.4
• immutable from 5.1.5 to 5.1.9
• js-yaml from 4.2.0 to 4.3.0
• nanoid from 3.3.11 to 3.3.16
• postcss from 8.5.13 to 8.5.23
• svgo from 4.0.1 to 4.0.2

This keeps the update lockfile-only and avoids npm audit fix --force, which may apply breaking changes to dependencies.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 80c473ab-4581-4e50-b704-b5a37fada86a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Lockfile-only npm audit fix updates for transitive dependency security patches

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Update package-lock.json via npm audit fix to pull patched transitive versions.
• Keep changes lockfile-only to avoid --force and potential breaking upgrades.
• Refresh resolved tarballs/integrity for brace-expansion, fast-uri, immutable, js-yaml, nanoid,
 postcss, svgo.

Diagram

graph TD
  A["Developer/CI"] --> B["npm audit fix"] --> C["package-lock.json"] --> D["npm ci / npm install"] --> E["Resolved transitive deps"]
  E --> F["Build / Tests"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Targeted direct dependency bumps (package.json) + regenerate lockfile

• ➕ Makes dependency intent explicit (not just transitive drift)
• ➕ Easier to track why versions changed and to pin semver ranges
• ➖ May require code/config changes if major/minor upgrades are needed
• ➖ More invasive than a lockfile-only security patch

2. `npm audit fix --force`

• ➕ Potentially resolves a wider set of advisories automatically
• ➖ Can introduce breaking changes via major upgrades
• ➖ Harder to review and riskier for runtime behavior

3. Use `overrides` (npm) to pin specific vulnerable transitive deps

• ➕ Precisely constrains only the vulnerable transitive packages
• ➕ More stable over time than repeated lockfile-only churn
• ➖ Adds ongoing maintenance burden and can mask dependency hygiene issues
• ➖ May cause resolution conflicts if upstream packages are incompatible

Recommendation: The lockfile-only npm audit fix approach is appropriate here to keep risk low and avoid forced breaking upgrades. The main follow-up is to confirm Node runtime compatibility: brace-expansion@5.0.8 tightens its engines to Node 20 || >=22 (dropping Node 18), so ensure CI/deploy images are on Node 20+ (or reconsider this update path if Node 18 support is required).

Files changed (1) +29 / -29

Other (1) +29 / -29

package-lock.jsonApply npm audit fix security patches to transitive lockfile entries +29/-29

Apply npm audit fix security patches to transitive lockfile entries

• Updates pinned versions, resolved URLs, and integrity hashes for several transitive dependencies (brace-expansion, fast-uri, immutable, js-yaml, nanoid, postcss, svgo). Also updates postcss's nanoid dependency range and reflects an engines constraint change for brace-expansion@5.0.8 (Node 20+).

package-lock.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 5 rules

1. Lockfile lines exceed 100 ✗ Dismissed 📘 Rule violation ⚙ Maintainability

Description

package-lock.json adds dependency metadata lines (e.g., resolved/integrity) that exceed 100
characters. This violates the repository’s 100-character max line-length requirement for changed
files and may cause style/lint checks to fail if enforced uniformly.

Code

package-lock.json[R4318-4319]

+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",

Evidence

PR Compliance ID 2261946 requires non-comment, non-whitespace lines in changed files to be <= 100
characters unless an explicit exemption exists. The updated resolved and integrity lines in
package-lock.json are significantly longer than 100 characters.

Rule 2261946: Limit source line length to 100 characters
package-lock.json[4318-4319]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR introduces/updates long `resolved` and `integrity` lines in `package-lock.json` that exceed the 100-character line-length limit.

## Issue Context
`package-lock.json` is typically auto-generated and contains long URLs and hashes that are not practical to wrap without altering semantics.

## Fix Focus Areas
- package-lock.json[4318-4319]
- (Add an ignore/exemption in the repo’s formatting/lint configuration for lockfiles so this rule does not apply to `package-lock.json`.)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---