fix(deps): resolve Dependabot alerts #657 and #658 (postcss, uuid)

[kherembourg]

Summary

• Add postcss >=8.5.10 override in test-projects/expo-purchasely-test/package.json (GHSA-qx2v-qp2m-jg93 — XSS via unescaped </style> in CSS Stringify Output)
• Add uuid >=14.0.0 override in the same project (GHSA-w5hq-g745-h8pq — buffer bounds check in v3/v5/v6 with buf arg)
• Lockfile resolves to postcss 8.5.12 and uuid 14.0.0; npm audit reports 0 vulnerabilities

Test plan

• npm install --package-lock-only regenerates the lockfile cleanly
• npm audit reports 0 vulnerabilities in the expo project
• CI build-android, build-ios, lint, test pass

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR resolves Dependabot alert #657 by adding a postcss >=8.5.10 override (resolves to 8.5.12 in the lockfile), and correctly drops the uuid override that was previously flagged as incompatible with xcode's CJS require('uuid') — instead the lockfile now scopes uuid@7.0.3 under node_modules/xcode/node_modules/uuid rather than hoisting it. The approach is sound and the CI build-ios/android steps remain the final validation gate.

Confidence Score: 5/5

Safe to merge — both dependency changes are correct and the previous uuid CJS-incompatibility concern has been properly addressed.

No P0 or P1 issues found. The postcss override cleanly addresses GHSA-qx2v-qp2m-jg93, and uuid@7.0.3 is correctly scoped to xcode's local node_modules to avoid the breaking CJS change in uuid v10+.

No files require special attention.

Important Files Changed

Filename	Overview
test-projects/expo-purchasely-test/package.json	Adds postcss >=8.5.10 override; uuid override removed per previous review feedback — clean dependency security fix
test-projects/expo-purchasely-test/package-lock.json	Lockfile updated: postcss bumped to 8.5.12, nanoid range updated to ^3.3.11 within postcss entry, and uuid@7.0.3 re-scoped to node_modules/xcode/node_modules/uuid (no longer hoisted) to avoid CJS compatibility issues

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[package.json overrides] -->|postcss override added| B["postcss@8.5.12 - GHSA-qx2v-qp2m-jg93 fixed"]
    A -->|uuid override removed| C[No top-level uuid hoisting]
    C --> D["xcode@5.0.1 - requires uuid ^7.0.3"]
    D -->|nested scoped install| E["node_modules/xcode/node_modules/uuid@7.0.3 - CJS compat preserved"]
    B --> F[npm audit: 0 vulnerabilities]
    E --> F

Loading

_{Reviews (2): Last reviewed commit: "fix(deps): drop uuid override (incompati..." | Re-trigger Greptile}

[kherembourg]

Greptile P1 finding addressed in 91e32cd (push-back per option 2):

#	Finding	Resolution
1	uuid 7→14 may break iOS builds (xcode CJS / Node ≥20)	Removed uuid override. No patched version exists in the v7 range; xcode is a build-time dev tool that uses uuid.v4() (random), not the v3/v5/v6 + buf paths in GHSA-w5hq-g745-h8pq. Dependabot alert #657 will be dismissed as tolerable_risk.
2	postcss XSS	Override postcss >=8.5.10 retained — lockfile resolves to 8.5.12 (no consumer compatibility issues).

[kherembourg]

@greptileai review