.Net: Bump postcss from 8.5.3 to 8.5.12 in /dotnet/samples/Demos/ProcessWithCloudEvents/ProcessWithCloudEvents.Client

[dependabot]

Bumps postcss from 8.5.3 to 8.5.12.

Release notes

Sourced from postcss's releases.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

8.5.8

• Fixed Processor#version.

8.5.7

• Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

• Fixed ContainerWithChildren type discriminating (by @​Goodwine).

8.5.5

• Fixed package.json→exports compatibility with some tools (by @​JounQin).

8.5.4

• Fixed Parcel compatibility issue (by @​git-sumitchaudhary).

Changelog

Sourced from postcss's changelog.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

8.5.8

• Fixed Processor#version.

8.5.7

• Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

• Fixed ContainerWithChildren type discriminating (by @​Goodwine).

8.5.5

• Fixed package.json→exports compatibility with some tools (by @​JounQin).

8.5.4

• Fixed Parcel compatibility issue (by @​git-sumitchaudhary).

Commits

• 9bc81c4 Release 8.5.12 version
• 85c4d7d Another try to fix coverage
• 94484ca Try to fix coverage
• c64b748 Load only .map source maps
• aaec7b7 Avoid throwing JSON parsing errors for non-JSON source maps
• 233fb26 Mention original author of the solution
• 2502f75 Release 8.5.11 version
• 5ca1901 Speed up parsing many nested brackets
• 42b5337 Update dependencies
• 7e36e15 Cache node.raws locally in Stringifier hot methods
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Automated Code Review

Reviewers: 4 | Confidence: 82%

✓ Correctness

This PR updates auto-generated lockfiles (package-lock.json and yarn.lock). The changes consist of: (1) removing "peer": true flags from packages that are already listed as direct dependencies or devDependencies in package.json (e.g., react, react-dom, @fluentui/react-components, @types/react, typescript, eslint, vite), which is consistent and correct; and (2) bumping postcss from 8.5.3 to 8.5.12 and its nanoid dependency from ^3.3.8 to ^3.3.11, which are routine transitive dependency updates. All changes are consistent with the existing package.json and appear to be the result of a normal npm install/yarn install regeneration. No correctness issues found.

✓ Security Reliability

This PR contains only lockfile changes (package-lock.json and yarn.lock) for a sample React client project. The changes are: (1) removal of "peer": true flags from packages that are already direct or dev dependencies in package.json (react, react-dom, @fluentui/react-components, @types/react, @types/react-dom, eslint, typescript, vite, etc.), which is a lockfile consistency fix; (2) postcss bumped from 8.5.3 to 8.5.12 (patch update); (3) nanoid dependency range updated from ^3.3.8 to ^3.3.11. All changes are auto-generated lockfile content consistent with the project's package.json. No security, reliability, or correctness issues found.

✓ Test Coverage

This PR only modifies auto-generated lock files (package-lock.json and yarn.lock) for a dotnet sample demo's React client. The changes remove peer: true flags from several dependencies and bump postcss (8.5.3 → 8.5.12) and its nanoid dependency (^3.3.8 → ^3.3.11). Since these are machine-generated dependency lock files with no application or test code changes, there are no test coverage concerns. No new or changed behavior exists that would require tests.

✗ Design Approach

The dependency bump itself is fine, but the PR continues a fragile dual-lockfile approach for this sample. The client README explicitly standardizes on Yarn, yet the change still updates both yarn.lock and package-lock.json, which means future transitive-security fixes have to be applied and reviewed in two generated files with no single source of truth.

Flagged Issues

• This sample maintains both yarn.lock and package-lock.json even though its documented workflow is Yarn-only (README.md lines 9, 19). Each future dependency refresh can drift across two lockfiles with no single source of truth. Standardize one package manager for this sample and commit only its lockfile.

---

Automated review by dependabot[bot]'s agents

[github-actions]

The sample README documents Yarn as the supported package manager, but this PR still updates a second lockfile. Keeping both yarn.lock and package-lock.json in sync is process-fragile and invites drift. Consider standardizing one package manager and committing only its lockfile.