chore(deps): clear Dependabot security alerts

[JohnMcLear]

Clears all open Dependabot security alerts on this repo. Both are development-scope transitive dependencies coming in through pnpm-lock.yaml, not from any direct dependency, so the fix is a pnpm.overrides entry plus a regenerated lockfile.

alert	severity	package	scope	was	now
#48	high	js-yaml	development	4.1.1	4.3.2
#47	high	js-yaml	development	4.1.1	4.3.2
#40	high	brace-expansion	development	1.1.14	1.1.21
#39	high	js-yaml	development	4.1.1	4.3.2
#38	medium	js-yaml	development	4.1.1	4.3.2

5 alerts closed: 4 high, 1 medium.

Notes

• pnpm update --recursive --latest does not move either package, because neither is a direct dependency — hence the overrides.
• js-yaml is overridden to ^4.3.2 rather than >=4.3.2 so it stays on the 4.x line (js-yaml 5.x would break eslint 8).
• The brace-expansion override is scoped to the 1.x line (brace-expansion@1) so that minimatch 10's brace-expansion 5.0.12 resolution is left alone.
• Diff is limited to the lockfile plus the overrides block. No unrelated dependency bumps.
• pnpm run lint passes with 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Override vulnerable transitive development dependencies

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Adds targeted pnpm overrides for vulnerable development-only transitive dependencies.
• Constrains js-yaml to 4.x and brace-expansion overrides to 1.x.
• Regenerates secure resolutions without changing brace-expansion 5.x dependencies.

Diagram

graph TD
  A["package.json"] -->|overrides| B["pnpm resolver"] -->|regenerates| C["pnpm-lock.yaml"]
  C -->|records| D["ESLint toolchain"] -->|uses| E["js-yaml 4.3.2"]
  C -->|records| F["Minimatch 3"] -->|uses| G["brace-expansion 1.1.21"]

Loading

High-Level Assessment

Targeted pnpm overrides are the best fit because the vulnerable packages are transitive and cannot be moved through direct dependency updates. The major-line constraints minimize compatibility risk, while the brace-expansion selector preserves the independent 5.x resolution; a broad toolchain upgrade or unscoped override would create unnecessary risk and lockfile churn.

Files changed (2) +16 / -14

Other (2) +16 / -14

package.jsonAdd scoped pnpm security overrides +6/-0

Add scoped pnpm security overrides

• Adds an override keeping js-yaml on a patched 4.x release. Adds a brace-expansion override limited to 1.x consumers so existing 5.x resolutions remain untouched.

package.json

pnpm-lock.yamlRegenerate secure transitive dependency resolutions +10/-14

Regenerate secure transitive dependency resolutions

• Records the new override configuration and resolves js-yaml from 4.1.1 to 4.3.2. Resolves brace-expansion 1.x from 1.1.14 to 1.1.21 while retaining brace-expansion 5.0.12.

pnpm-lock.yaml