chore(deps): clear Dependabot security alerts

[JohnMcLear]

Clears all open Dependabot security alerts on this repo. Every one is a
development-scope transitive dependency pulled in through pnpm-lock.yaml
(via eslint / @eslint/eslintrc and minimatch@3), not a direct dependency,
so the fix is to force the patched versions rather than edit dependencies.

pnpm update js-yaml brace-expansion --recursive --latest does not move
transitive-only packages, so this uses major-scoped pnpm.overrides:

"pnpm": { "overrides": { "js-yaml@4": "^4.3.2", "brace-expansion@1": "^1.1.16" } }

Scoping to the affected major line matters: an unbounded >=4.3.2 / >=1.1.16
drags eslint's js-yaml to 5.x and minimatch@3's brace-expansion to 5.x.
With the ranges above, resolution is:

package	before	after
js-yaml (eslint 8.57.1, @eslint/eslintrc 2.1.4)	4.1.1	4.3.2
js-yaml (mocha 12)	5.4.1	5.4.1 (untouched)
brace-expansion (minimatch 3.1.5)	1.1.14	1.1.21
brace-expansion (minimatch 10.2.6)	5.0.12	5.0.12 (untouched)

Alerts closed

#	severity	package	scope	first patched
41	high	js-yaml	development	4.3.2
40	high	js-yaml	development	4.3.1
33	high	brace-expansion	development	1.1.16
32	high	js-yaml	development	4.3.0
31	medium	js-yaml	development	4.2.0

4 high, 1 medium.

pnpm run lint passes with 0 errors. Dev-scope only - no user-facing change.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Pin vulnerable transitive development dependencies

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Pin vulnerable js-yaml 4 and brace-expansion 1 transitive dependencies to patched ranges.
• Regenerate the pnpm lockfile while preserving unaffected major-version dependency lines.

Diagram

graph TD
  A["package.json"] --> B["pnpm resolver"] --> C["pnpm lockfile"]
  B --> D["ESLint stack"] --> E["js-yaml 4.3.2"]
  B --> F["minimatch 3"] --> G["brace-expansion 1.1.21"]

Loading

High-Level Assessment

Major-scoped pnpm overrides are the appropriate approach because the vulnerable packages are transitive-only and ordinary recursive updates do not move them. Upgrading parent tooling would create unnecessary migration scope, while unbounded overrides could force incompatible major versions into unrelated dependency chains.

Files changed (2) +16 / -14

Other (2) +16 / -14

package.jsonAdd major-scoped security overrides +6/-0

Add major-scoped security overrides

• Adds pnpm overrides requiring patched js-yaml 4 and brace-expansion 1 releases. Major scoping prevents unrelated 5.x dependency lines from moving.

package.json

pnpm-lock.yamlResolve vulnerable transitive packages to patched releases +10/-14

Resolve vulnerable transitive packages to patched releases

• Records the overrides and replaces js-yaml 4.1.1 with 4.3.2 and brace-expansion 1.1.14 with 1.1.21 across affected development dependency snapshots. Existing newer major lines remain unchanged.

pnpm-lock.yaml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗