Fix dependency security advisories

[dannyhw]

Issue: Dependabot alerts 298, 299, 301–304, and 306

What I did

• Refreshed the lockfile so the existing upstream dependency ranges select patched releases of body-parser, fast-uri, fast-xml-parser, find-my-way, postcss, and svgo.
• Kept this as a lockfile-only change with no new dependency overrides or package manifest changes.
• Intentionally excluded Dependabot alert 305 for valibot. @storybook/mcp@0.8.0 pins the vulnerable version exactly, so that should be fixed in the MCP package instead of overridden in this repository. The upstream work is tracked in storybookjs/mcp#372.

How to test

• pnpm install --frozen-lockfile
• pnpm build
• pnpm check
• pnpm audit --audit-level low --json

The frozen install and supply-chain policy verification pass. The complete repository check passes, including TypeScript, lint, formatting, Expo validation, and all tests.

The audit now reports only the intentionally deferred valibot advisory and a separate brace-expansion advisory. The remaining brace-expansion paths come from the current ESLint dependency tree and are outside the Dependabot alerts addressed by this PR.

• This does not need a new example in examples/expo-example.
• This does not need a documentation update.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 410ba8a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR