chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 2 open Dependabot security alerts by scoping npm overrides to the specific transitive dependency paths pulling in vulnerable js-yaml versions.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#66	js-yaml (< 3.15.0, via @istanbuljs/load-nyc-config -> babel-plugin-istanbul -> babel-jest -> react-native)	medium	Overridden to ^3.15.0
#65	js-yaml (>= 4.0.0, <= 4.1.1, via @expo/xcpretty -> @expo/cli -> expo)	medium	Overridden to ^4.2.0

Both are transitive dev-tooling dependencies (Jest/Istanbul coverage tooling and Expo's xcpretty log formatter), so scoped overrides were used rather than bumping the parent packages, avoiding pulling in unrelated major version changes. npm install confirms both resolve to patched versions (js-yaml@3.15.0 and js-yaml@4.3.0), and npm audit reports 0 vulnerabilities.

This repo has no test/lint/build scripts and no CI workflows; npx tsc --noEmit passes with no errors.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f23a410d-973f-44e5-a55d-225c7599e464

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR addresses Dependabot-reported security vulnerabilities in transitive js-yaml dependencies by adding targeted npm overrides, ensuring patched js-yaml versions are selected without broadly upgrading parent toolchain packages.

Changes:

• Added scoped npm overrides to force patched js-yaml versions for @istanbuljs/load-nyc-config and @expo/xcpretty.
• Updated package-lock.json to reflect resolved patched versions (js-yaml@3.15.0 and js-yaml@4.3.0).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds scoped overrides to pin vulnerable transitive js-yaml paths to patched ranges.
package-lock.json	Updates the lockfile to reflect the patched js-yaml resolutions (3.15.0 and 4.3.0).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.