[Snyk] Fix for 1 vulnerabilities

[Eric-Guo]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Infinite loop SNYK-JS-BRACEEXPANSION-15789759

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[Copilot]

Pull request overview

This PR updates JavaScript dependencies to remediate a reported brace-expansion vulnerability by upgrading packages that pull it in.

Changes:

• Bump patch-package from ^6.5.1 to ^8.0.1
• Bump webpack-dev-server from ^4.15.2 to ^5.1.0

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This repo uses pnpm (see packageManager: "pnpm@10.33.0") and has a committed pnpm-lock.yaml, but this PR changes dependency versions without updating the lockfile. Please re-run pnpm install (or pnpm update) and commit the resulting pnpm-lock.yaml changes so installs/CI are reproducible and the vulnerability remediation is actually applied.

Suggested change

	"sass": "1.77.6",
	"sass": "^1.77.6",

[Copilot]

webpack-dev-server is bumped to ^5.1.0, but shakapacker@9.6.1 declares a peer dependency of webpack-dev-server: ^4.15.2 || ^5.2.2 (see pnpm-lock.yaml). With pnpm, this will at least produce a peer mismatch and may prevent the dependency tree from resolving cleanly. Consider changing the range to ^5.2.2 (or otherwise aligning with Shakapacker’s supported versions) and regenerate the lockfile.

Suggested change

	"webpack-dev-server": "^5.1.0",
	"webpack-dev-server": "^5.2.2",