chore(deps): clear Dependabot security alerts

[JohnMcLear]

Clears all 5 open Dependabot alerts on this repo (4 high, 1 medium). Both packages are development-scope transitives pulled in through pnpm-lock.yaml, not direct dependencies.

#	severity	package	from	to	first patched
47	high	js-yaml	4.1.1	4.3.2	4.3.2
46	high	js-yaml	4.1.1	4.3.2	4.3.1
39	high	brace-expansion	1.1.14	1.1.21	1.1.16
38	high	js-yaml	4.1.1	4.3.2	4.3.0
37	medium	js-yaml	4.1.1	4.3.2	4.2.0

pnpm update js-yaml brace-expansion --recursive leaves both on the vulnerable versions, so the fix is a pnpm.overrides entry scoped to the existing major (js-yaml@4, brace-expansion@1) plus a regenerated lockfile. Scoping to the major matters: a bare >=1.1.16 resolves every brace-expansion consumer — including minimatch@3 — up to 5.x.

Diff is the lockfile plus the override block; no other dependencies bumped, nothing user-facing changes.

Verified: pnpm install clean, pnpm run lint passes with 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Patch vulnerable transitive development dependencies

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Adds major-scoped pnpm overrides for patched js-yaml and brace-expansion releases.
• Regenerates the lockfile to remediate five development-only Dependabot security alerts.
• Avoids unrelated dependency and runtime changes.

Diagram

graph TD
  A["package.json"] --> B["Major overrides"] --> C["pnpm lockfile"] --> D["ESLint tooling"] --> E["js-yaml 4.3.2"]
  C --> F["minimatch 3"] --> G["brace-expansion 1.1.21"]

Loading

High-Level Assessment

The major-scoped pnpm overrides are the best targeted approach because recursive updates do not replace the vulnerable transitives. Upgrading parent tooling would create broader unrelated churn, while unscoped overrides could incorrectly promote minimatch consumers to brace-expansion 5.x.

Files changed (2) +16 / -14

Other (2) +16 / -14

package.jsonAdd major-scoped security overrides +6/-0

Add major-scoped security overrides

• Adds pnpm overrides that require patched js-yaml 4.x and brace-expansion 1.x releases. Major scoping prevents incompatible promotion of existing consumers to newer major versions.

package.json

pnpm-lock.yamlResolve vulnerable transitives to patched releases +10/-14

Resolve vulnerable transitives to patched releases

• Records the new overrides and replaces js-yaml 4.1.1 with 4.3.2 and brace-expansion 1.1.14 with 1.1.21. Existing ESLint and minimatch consumers now resolve to patched versions without other dependency upgrades.

pnpm-lock.yaml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗