chore: Remediate 2 Dependabot security alerts (lockfile only)

[ernst-dev]

Automated Dependabot security-alert remediation

Alert-driven remediation of this repository's open Dependabot security alerts.
Baseline: 5c84a544e on main.

Alerts resolved (2 of 2)

Alert	Sev	Package	Major line	Vulnerable range	First patched	Now resolved to	Advisory
#55	high	brace-expansion	1.x	< 1.1.16	1.1.16	2.1.4, 1.1.18	GHSA-3jxr-9vmj-r5cp (CVE-2026-13149)
#56	high	postcss	8.x	<= 8.5.17	8.5.18	8.5.25	GHSA-r28c-9q8g-f849 (—)

How this was remediated

• Rung 1 — npm audit fix --package-lock-only --ignore-scripts (no --force was used anywhere in this run).
• The repo's own prepare-package-lock convention (postinstall in @cloudscape-design/build-tools) was applied afterwards, so no @cloudscape-design/* entries are (re-)introduced into the lockfile.
• npm's full reconciliation additionally healed unrelated pre-existing lockfile drift (stale entries, dev/optional flags, unrelated minor bumps). That collateral was deliberately discarded: only the security-relevant entries from npm's computed result were applied on top of the committed lockfile, so this diff contains alert-driven changes only.
• Verified with npm ls --package-lock-only --all: zero new unmet/invalid dependency problems versus main.

Lockfile changes (6)

Package	From	To	Scope	Lockfile path
brace-expansion	2.0.3	2.1.4	dev	node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
brace-expansion	1.1.13	1.1.18	dev	node_modules/brace-expansion
brace-expansion	2.0.3	2.1.4	dev	node_modules/glob/node_modules/brace-expansion
nanoid	3.3.12	3.3.16	dev	node_modules/nanoid
postcss	8.5.15	8.5.25	dev	node_modules/postcss
yaml	(new)	2.9.0	dev	node_modules/vitest/node_modules/yaml

NPMPM (NpmPrettyMuch) availability — internal build safety

Not applicable — 0 non-dev dependencies changed. Every version bump in this PR is dev: true, which the NPMPM availability check skips, so there is no internal-build (Brazil) impact and the check should come back green.

Does merging clear this repository's alert list?

Yes. Merging this PR is expected to close all 2 of this repository's currently-open Dependabot security alerts.

---

_{Existing Dependabot-authored PRs were deliberately not touched, reviewed, rebased, or closed by this run.}

Opened by roko-dependabot on behalf of @ernst-dev. Alert-driven remediation; not merged — a human must review and merge.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.57%. Comparing base (5c84a54) to head (19012ed).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #122   +/-   ##
=======================================
  Coverage   94.57%   94.57%           
=======================================
  Files          11       11           
  Lines         516      516           
  Branches      142      142           
=======================================
  Hits          488      488           
  Misses         28       28           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.