From facb39ab9692854792f4827ce023a603dcb7fdf4 Mon Sep 17 00:00:00 2001
From: Luke Fretwell <luke@lukefretwell.com>
Date: Sun, 2 Aug 2026 21:07:25 -0700
Subject: [PATCH] Fix npm dependency vulnerabilities via package.json overrides

package-lock.json is gitignored here, so npm audit fix has nothing
to commit. Pin brace-expansion and postcss to their patched versions
via overrides instead. Also rebuilt scripts/bundle.css, which had
fallen behind the already-merged feedback-button CSS change.

Part of ScanGov/scangov-com#193
---
 package.json       | 4 +++-
 scripts/bundle.css | 9 ++++++++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index e25d821e..9f766930 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,9 @@
     "purgecss": "^7.0.2"
   },
   "overrides": {
-    "sharp": "^0.35.3"
+    "sharp": "^0.35.3",
+    "brace-expansion": "^1.1.18",
+    "postcss": "^8.5.25"
   },
   "keywords": [],
   "author": "",
diff --git a/scripts/bundle.css b/scripts/bundle.css
index 9dd8ae4c..5e4c1a84 100644
--- a/scripts/bundle.css
+++ b/scripts/bundle.css
@@ -1011,12 +1011,19 @@ button.btn-secondary-outline {
     cursor: pointer;
     position: fixed;
     bottom: 1rem;
-    right: 1rem;
+    left: 50%;
+    transform: translateX(-50%);
     z-index: 1000;
     text-decoration: none;
     transition: opacity 0.25s ease, visibility 0.25s ease, filter 0.25s ease, box-shadow 0.25s ease;
 }
 
+.feedback.feedback-right {
+    left: auto;
+    right: 1rem;
+    transform: none;
+}
+
 .feedback.is-visible {
     opacity: 1;
     pointer-events: auto;