chore(deps): clear Dependabot security alerts

[JohnMcLear]

Clears all open Dependabot security alerts on this repo. Every one is a
development-scope transitive dependency pulled in through pnpm-lock.yaml
(via eslint / @eslint/eslintrc and minimatch@3), not a direct dependency,
so the fix is to force the patched versions rather than edit dependencies.

pnpm update js-yaml brace-expansion --recursive --latest does not move
transitive-only packages, so this uses major-scoped pnpm.overrides:

"pnpm": { "overrides": { "js-yaml@4": "^4.3.2", "brace-expansion@1": "^1.1.16" } }

Scoping to the affected major line matters: an unbounded >=4.3.2 / >=1.1.16
drags eslint's js-yaml to 5.x and minimatch@3's brace-expansion to 5.x.
With the ranges above, resolution is:

package	before	after
js-yaml (eslint 8.57.1, @eslint/eslintrc 2.1.4)	4.1.1	4.3.2
js-yaml (mocha 12)	5.4.1	5.4.1 (untouched)
brace-expansion (minimatch 3.1.5)	1.1.14	1.1.21
brace-expansion (minimatch 10.2.6)	5.0.12	5.0.12 (untouched)

Alerts closed

#	severity	package	scope	first patched
47	high	js-yaml	development	4.3.2
46	high	js-yaml	development	4.3.1
40	high	brace-expansion	development	1.1.16
39	high	js-yaml	development	4.3.0
38	medium	js-yaml	development	4.2.0

4 high, 1 medium.

pnpm run lint passes with 0 errors. Dev-scope only - no user-facing change.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Pin patched transitive development dependencies with pnpm overrides

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Adds major-scoped overrides for patched js-yaml and brace-expansion releases.
• Regenerates vulnerable ESLint and minimatch development dependency resolutions.
• Preserves unaffected package majors and avoids user-facing runtime changes.

Diagram

graph TD
  A["package.json"] --> B["pnpm resolver"] --> C["pnpm-lock.yaml"]
  B --> D["js-yaml 4.3.2"] --> F["ESLint stack"]
  B --> E["brace-expansion 1.1.21"] --> G["minimatch 3"]

Loading

High-Level Assessment

Major-scoped pnpm overrides are the appropriate solution for transitive-only vulnerabilities that recursive updates cannot advance. Direct dependency declarations would misrepresent package ownership, while unbounded overrides could introduce incompatible major versions; the submitted approach avoids both issues.

Files changed (2) +16 / -14

Other (2) +16 / -14

package.jsonAdd major-scoped security overrides +6/-0

Add major-scoped security overrides

• Adds pnpm overrides that require patched js-yaml 4.x and brace-expansion 1.x releases. Major scoping prevents unrelated newer dependency lines from being replaced.

package.json

pnpm-lock.yamlResolve vulnerable transitive packages to patched releases +10/-14

Resolve vulnerable transitive packages to patched releases

• Records the new override configuration and replaces js-yaml 4.1.1 with 4.3.2 and brace-expansion 1.1.14 with 1.1.21. Existing js-yaml 5.x and brace-expansion 5.x resolutions remain unchanged.

pnpm-lock.yaml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗