chore(web): patch vulnerable transitive dependencies

[markmur]

Summary

• Pin patched brace-expansion, fast-uri, and postcss releases.
• Pin nanoid 3.x to 3.3.18, including the vulnerable copy not yet shown on the Dependabot dashboard.
• Regenerate the Web lockfile without changing direct dependencies.

Stack

1. chore(react-native): replace vulnerable URI decoder #719
2. chore(react-native): patch vulnerable transitive dependencies #718
3. chore(web): patch vulnerable transitive dependencies #717 ← This PR
4. chore(protocol): patch vulnerable transitive dependencies #716

[github-actions]

Web — Coverage Report

Lines	Statements	Branches	Functions
	94.47% (342/362)	81.77% (166/203)	96.84% (92/95)

[github-actions]

Package Size

Platform	Artifact	Base	Head	Delta
Web	npm tarball	80.1 KiB	80.1 KiB	0 B

Web file breakdown

File	Base	Head	Delta
dist/index.js.map	217.7 KiB	217.7 KiB	0 B
dist/custom-elements.json	51.4 KiB	51.4 KiB	0 B
dist/index.d.ts	45.9 KiB	45.9 KiB	0 B
dist/index.js	39.5 KiB	39.5 KiB	0 B
README.md	20.0 KiB	20.0 KiB	0 B
package.json	2.9 KiB	2.9 KiB	0 B
LICENSE	1.1 KiB	1.1 KiB	0 B

Measured from the PR base SHA and PR head SHA. The file breakdown shows uncompressed sizes within each package artifact, so individual files do not sum to the compressed artifact total. This comment reports package artifact sizes only; it is not a final app binary-size report.

[bitrise]

Install this build

Open Tophat, select your target device, then click Install. Links open on the Mac running Tophat.

SDK	Install
React Native	Install with Tophat
Swift	Install with Tophat
Kotlin	Install with Tophat

Checkout Kit E2E results

Status	Tags	Target	Platform	OS version tag	Device
✅	launch, checkout-presentation, checkout-completion, buyer-identity	react-native	ios	latest	iPhone 15 iOS 27 Beta
✅	launch, checkout-presentation, checkout-completion, buyer-identity	react-native	android	latest	Google Pixel 9 Android 17.0
✅	launch, checkout-presentation, checkout-completion, buyer-identity, preload	kotlin	android	latest	Google Pixel 9 Android 17.0
✅	launch, checkout-presentation, checkout-completion, buyer-identity, preload	swift	ios	latest	iPhone 15 iOS 27 Beta