[davidacevedo]

Dependabot sweep: react-gears

Resolves 2 of 4 open npm alerts. Lockfile-only change, no manifest edits.

Fixed

• gt - Update FeatureBanner to use reactstrap Alert #211 source-map-js 1.2.1 -> 1.2.2 (GHSA-68fv-2mgg-jv7q, HIGH)
  Event-loop DoS via indexed source-map section offsets.
  Re-resolved in range with yarn up -R source-map-js.
• Remove lodash.over #213 postcss-selector-parser 6.1.4 -> 7.1.7 (GHSA-rj75-hqrm-r3gf, MODERATE)
  Quadratic complexity in flat selector parsing (CPU exhaustion).
  yarn up -R alone only reached 6.1.5 (still vulnerable; parents
  postcss-modules-local-by-default and postcss-modules-scope pinned
  it to ^6.0.x). Bumped those two grandparents within css-loader's
  own declared range (^4.0.5, ^3.2.0) to their latest published
  versions (4.2.0, 3.2.1), which depend on postcss-selector-parser@^7.0.0.

Not fixed (Hard, left open)

• Add waiting #199 @vitest/mocker (GHSA-82fw-gwwq-j7x9, MODERATE) — exact-pinned to
  3.2.4 by storybook@9.1.20 (the newest published 9.x). Reaching the
  patched 4.1.11 needs the storybook 10 major, which requires TypeScript 5;
  this repo pins typescript to ^4.9.5. No code-change route attempted
  per sweep scope.
  https://github.com/appfolio/react-gears/security/dependabot/199
• InfoBox border color does not update in some cases #204 webpack-dev-middleware (GHSA-g84c-rxfj-3j2c, HIGH) — declared
  ^6.1.2 by @storybook/builder-webpack5@9.1.20 (newest published 9.x),
  resolving to 6.1.3. Patched 7.4.6 is a new major, only available via
  storybook 10 — same TypeScript 5 blocker as Add waiting #199.
  https://github.com/appfolio/react-gears/security/dependabot/204

Scope

git diff --stat origin/master shows only yarn.lock changed (15
insertions, 15 deletions) — no package.json edit, so manifests_changed
is empty. No dedupe ran (not needed: yarn up -R + the two grandparent
bumps left zero vulnerable copies for the two fixed rows).

Evidence

$ yarn why postcss-selector-parser
├─ postcss-modules-local-by-default@npm:4.2.0
│  └─ postcss-selector-parser@npm:7.1.7 (via npm:^7.0.0)
├─ postcss-modules-scope@npm:3.2.1
│  └─ postcss-selector-parser@npm:7.1.7 (via npm:^7.0.0)

$ yarn why source-map-js
(resolves to 1.2.2 everywhere)

Testing Plan

Both bumped packages are devDependency-only build-tool transitives
(PostCSS/css-loader pipeline, source-map tooling). No call sites in
src/ (grep -rl "source-map-js\|postcss-selector-parser" src/ → no
matches), so there is no application code path to exercise manually.
Verification is: install succeeds, lockfile no longer contains the
vulnerable version strings, and CI (test.yml, prerelease.yml) is
green on this branch.

CI on react-gears runs on every push with no trigger labels needed
(per the repo operating card).

🤖 Generated with Claude Code

[github-actions]

Released prerelease version 8.19.7-boyz-dependabot-sweep-react-gears-easy-2026-10-20-129757-1e65648.0.
You may now run npm install @appfolio/react-gears@boyz-dependabot-sweep-react-gears-easy-2026-10-20-129757

[supernova-dx-appf-io]

👀 Heads up: Supernova won't automatically act on bot reviews (like @github-actions[bot]). If you'd like me to evaluate or implement a suggestion, just reply here!

[supernova-dx-appf-io]

Supernova has stopped updating this pull request's title and description.

The description was edited outside Supernova after Supernova last wrote it, so later pushes will leave the title and description as they are instead of replacing those changes.

To have Supernova keep them up to date again, turn automatic updates back on. You'll be asked to confirm first, because turning them back on replaces the current description with a newly generated one.