[supernova-dx-appf-io]

Dependabot sweep: re-resolves 2 npm alerts within existing declared ranges.
Lockfile-only change (yarn.lock); no package.json ranges changed.

Fixed

• source-map-js 1.2.1 -> 1.2.2 (alert gt - Update FeatureBanner to use reactstrap Alert #211, GHSA-68fv-2mgg-jv7q, HIGH)
  • Transitive via postcss@8.5.25 (^1.2.1); yarn up -R re-resolved in range.
• postcss-selector-parser 6.1.4 -> 7.1.7 (alert Remove lodash.over #213, GHSA-rj75-hqrm-r3gf, MODERATE)
  • Patched version 7.1.6 is a major bump, outside css-loader@6.11.0's
    ^6.0.2/^6.0.4 ranges on its parents. Fixed by bumping the parents
    themselves within css-loader's own range:
    postcss-modules-local-by-default 4.0.5 -> 4.2.0 and
    postcss-modules-scope 3.2.0 -> 3.2.1, both of which declare
    postcss-selector-parser@^7.0.0.

Collateral (not alerted, needed to carry the postcss-selector-parser fix)

• postcss-modules-local-by-default 4.0.5 -> 4.2.0
• postcss-modules-scope 3.2.0 -> 3.2.1

No dedupe ran: the grep for vulnerable version strings showed zero hits after
the above re-resolves, so dedupe was skipped per procedure.

Not fixed (Hard)

• @vitest/mocker 3.2.4, alert Add waiting #199, GHSA-82fw-gwwq-j7x9, MODERATE.
  Exact-pinned (3.2.4, no range) by storybook@9.1.20. yarn up cannot
  move an exact pin. Storybook 10 would carry the patched @vitest/mocker
  but needs TypeScript 5, which this repo's typescript@^4.9.5 pin blocks.
  Needs a coordinated storybook + TypeScript major bump — a code change,
  so out of scope for this sweep.
• webpack-dev-middleware 6.1.3, alert InfoBox border color does not update in some cases #204, GHSA-g84c-rxfj-3j2c, HIGH.
  Held by @storybook/builder-webpack5@9.1.20 (^6.1.2), patched 7.4.6 is
  a major bump. Newest 9.x release of @storybook/builder-webpack5
  (9.1.21) still declares webpack-dev-middleware@^6.1.2, so there's no
  in-range parent bump available. Same storybook-major blocker as above.

Scope

• git diff --stat origin/master shows only yarn.lock; no
  package.json ranges changed, so manifests_changed is empty.
• All four moved packages are devDependency build-tooling transitives
  (postcss/css-loader chain, used by storybook's webpack5 builder) with
  no call sites in src/ app code.

Testing Plan

• yarn install --immutable (with .yarnrc-public.yml) succeeds.
• Lockfile no longer contains source-map-js@npm:1.2.1 or
  postcss-selector-parser@npm:6.1.4.
• No app code call sites for any of the four moved packages, so no
  behavioral test beyond CI (build/lint/typecheck/storybook build) applies.

[github-actions]

Released prerelease version 8.19.7-boyz-dependabot-sweep-react-gears-easy-2026-10-22-af07d185-2ccdc66.0.
You may now run npm install @appfolio/react-gears@boyz-dependabot-sweep-react-gears-easy-2026-10-22-af07d185

[supernova-dx-appf-io]

👀 Heads up: Supernova won't automatically act on bot reviews (like @github-actions[bot]). If you'd like me to evaluate or implement a suggestion, just reply here!

[supernova-dx-appf-io]

Supernova has stopped updating this pull request's title and description.

The description was edited outside Supernova after Supernova last wrote it, so later pushes will leave the title and description as they are instead of replacing those changes.

To have Supernova keep them up to date again, turn automatic updates back on. You'll be asked to confirm first, because turning them back on replaces the current description with a newly generated one.