[FIX] dependabot vulnrability issues

[ilan7empest]

📝 Description

1. Fix PostCSS line return parsing error
2. Fix tmp allows arbitrary temporary file / directory write via symbolic link dir parameter
3. Fix qs's arrayLimit bypass in comma parsing allows denial of service

---

🛠️ Changes Made

• Update dependencies

---

✅ Checklist

• I have given the PR a well-structured title describing the domain and the specific change that was made
• I tested the changes in the browser (locally or via preview build)
• I confirmed that existing tests pass
• I added or updated unit / integration tests (if needed)
• I checked that this change doesn’t introduce new console warnings or lint / formatting errors
• I updated the relevant Jira ticket with the appropriate details and status

---

🔗 References

• Related ticket / issue: ML-12108, ML-12109, ML-12170
• Figma / design spec:
• Documentation:

---

🚨 Potentially Breaking Changes

• Yes
• No

---

Includes DRC change

• Yes
• No

If yes -> requires bump NPM version

---

🔍 Additional Notes

---

📸 Screenshots / Demos

---

[Copilot]

Pull request overview

This PR addresses security vulnerabilities in dependencies by updating three key packages: PostCSS, tmp, and qs. The changes also include a major version update to @cucumber/cucumber (v10 to v12) and various transitive dependency updates reflected in the package-lock.json.

Changes:

• Updated qs from ^6.14.1 to ^6.14.2 (resolves to 6.15.0) to fix denial of service vulnerability
• Updated postcss from ^8.4.36 to 8.4.49 (pinned version) to fix line return parsing error
• Added override for tmp at ^0.2.4 (resolves to 0.2.5) to fix arbitrary file/directory write vulnerability
• Updated @cucumber/cucumber from ^10.3.1 to 12.6.0 (major version bump with pinned version)
• Updated package-lock.json with all transitive dependency changes

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 4 comments.

File	Description
package.json	Updated dependency versions for qs, postcss, and @cucumber/cucumber; added overrides for qs and tmp
package-lock.json	Comprehensive lock file update reflecting all direct and transitive dependency changes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.