Patch-Package security vulnerability

[matthewoden]

Dependabot flagged this project because it requires patch-package, which has a YAML dependency on the current version. Looks like patch-package 7.0.0 has the fix.

I can submit a PR, but I don't super understand what the package is accomplishing, so I don't know how to test if it broke anything.

[kravets-levko]

Hi @matthewoden! Yes, I saw a warning recently, but at that time the "fix" was to rollback patch-package to some previous version. So thank you for letting me know that v7 got released 🙂 Probably in this particular case I'll upgrade it myself, since the mechanism we use it for is somewhat fragile. But generally updating dependencies just goes through a regular PR review process, no special prerequisites required