chore: resolve open dependabot security alerts

[jonathannorris]

Summary

Resolves the open Dependabot alerts that have a lockfile-level fix available. Two alerts are deferred (unresolvable without a larger migration) and one has no patched version at all — see notes below.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#243	js-yaml	high	Overrode js-yaml@>=4.0.0 <4.3.1 to ^4.3.1 (nx/eslint/cosmiconfig pin 4.3.0)
#247	js-yaml	high	Overrode js-yaml@>=3.0.0 <3.15.1 to ^3.15.1 (splitio 10.x/istanbul/markdown-toc pin 3.15.0)

Deferred / Unresolvable

• fix(deps): update dependency @splitsoftware/splitio-browserjs to v0.9.6 - autoclosed #229 react-router-dom (moderate) — no patched version exists for the 6.x line; the advisory's fix requires the v7 major.
• chore(deps): update dependency styled-components to v6 #228 / chore(deps): bump protobufjs from 7.2.3 to 7.2.4 #230 react-router (moderate) — patched version is 7.18.0, but the app is pinned to react-router-dom@^6.30.3, which requires react-router-dom v7. That in turn requires bumping React 17 → 18 (a breaking peer-dependency change) plus a router API migration. Deferred to a dedicated migration rather than folding into a security-only PR.
• Broken link to after hook #233 nx (medium) — patched version 22.7.2 is 4+ majors ahead of the pinned nx/@nx/* toolchain (17.3.2/18.3.5) and would require a full nx migrate across the monorepo. The advisory affects the nx graph dev server's permissive CORS policy, which this repo's scripts never invoke, so practical risk is low.

Verified locally: build, lint, and test all pass with npm install --legacy-peer-deps --ignore-scripts (matching CI's install flags).

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 080d8fd4-2b6d-4978-8722-6bee9158a29a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 080d8fd4-2b6d-4978-8722-6bee9158a29a

📥 Commits

Reviewing files that changed from the base of the PR and between 4814e6a and 470195c.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The package configuration replaces one js-yaml override with separate overrides for vulnerable ranges below 4.3.1 and 3.15.1.

Changes

Dependency override update

Layer / File(s)	Summary
js-yaml version range overrides package.json	The js-yaml override now covers versions below 4.3.1 and 3.15.1 with separate ranges.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 47019

This change updates vulnerable dependency resolutions in the package manifests and lockfile, with build, lint, and test checks reported as passing; no actionable merge-blocking risk remains beyond normal review and checks.

Possibly related PRs

• open-feature/playground#423: Both PRs update the package.json js-yaml override range.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the security-alert resolution, which matches the primary changes to dependency overrides.
Description check	✅ Passed	The description accurately explains the resolved js-yaml alerts, deferred alerts, and validation results.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jonathannorris]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[jonathannorris]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 57 minutes.

[coderabbitai]

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.