fix(security): clear all 4 Dependabot alerts — js-yaml 4.3.2, brace-expansion 1.1.18 (INF-3002)

[andriy-sudo]

Clearance work for INF-3002, which unblocks INF-3000.

agentql is one of the 22 repos opted out of Dependabot security updates in github-control, because a repo-wide vulnerability-check gates main and a dirty main makes Dependabot PRs unmergeable. It carries 4 open alerts, all in examples/js/package-lock.json, and all fixable — no risk acceptance needed. This clears them so the opt-out can be deleted.

Alerts cleared

Package	Old	New	Advisory	CVE	Sev	CVSS	Fix floor	Status
js-yaml	4.2.0	4.3.2	GHSA-52cp-r559-cp3m	CVE-2026-59869	high	7.5	4.3.0	✅ Fixed
js-yaml	4.2.0	4.3.2	GHSA-5p4m-2wfm-xmqj	—	high	7.5	4.3.1	✅ Fixed
js-yaml	4.2.0	4.3.2	GHSA-2883-xcg3-v3hh	CVE-2026-84375	high	7.5	4.3.2	✅ Fixed
brace-expansion	1.1.15	1.1.18	GHSA-3jxr-9vmj-r5cp	CVE-2026-13149	high	5.3	1.1.16	✅ Fixed

Three js-yaml advisories carry different fix floors (4.3.0 / 4.3.1 / 4.3.2), so the target is the highest, not the first — clearing only the lowest would have left the gate red.

Why exact pins instead of carets

The overrides already existed as "js-yaml": "^4.2.0" and "brace-expansion": "^1.1.13", and both resolved to vulnerable versions despite the fixes being inside those ranges. Exact pins (4.3.2, 1.1.18) make the floor unambiguous and match the resolved version, so there is no "floor below the fix" gap.

Both stay within their existing major line — 4.3.2 is the newest 4.x, 1.1.18 the newest 1.x — so no consumer is dragged across a major boundary. (js-yaml 5.x and brace-expansion 5.x exist; neither is used here.)

Verification

OSV  js-yaml@4.2.0           3 vulns  ->  js-yaml@4.3.2           0 vulns
OSV  brace-expansion@1.1.15  3 vulns  ->  brace-expansion@1.1.18  0 vulns
npm audit --package-lock-only            found 0 vulnerabilities

The lock was regenerated with npm install --package-lock-only --ignore-scripts. Local node is 25 / npm 11.6.2 against CI's node 18, which is the known combination that can silently drop linux-only optionalDependencies, so I ran the guard explicitly:

removed node_modules entries: 0
added   node_modules entries: 0
diffstat:                     6 insertions, 6 deletions

Only version/resolved/integrity lines changed — nothing dropped.

osv-scanner.toml at the repo root has no active suppressions (the former pygments ignore was already retired when that fix shipped), so there was nothing to re-adjudicate.

All changes are limited to manifest and lock file version bumps — no functional source code changes. Both packages are dev-scoped in an examples project.

Next

Once this merges and vulnerability-check is green on main, agentql's opt-out line in github-control/repos.tf can be deleted, the same shape as #1591 did for disaster and tf-common.

🤖 Generated with Claude Code

https://claude.ai/code/session_015PGXWenEJnUqbsVcZuwV5m

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 977b815d-3fb8-405f-9a7d-bcfc37645e90

📥 Commits

Reviewing files that changed from the base of the PR and between f561f14 and 4d1ed3b.

⛔ Files ignored due to path filters (1)

• examples/js/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• examples/js/package.json

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The JavaScript example now pins the brace-expansion override to 1.1.18 and the js-yaml override to 4.3.2. Other overrides remain unchanged.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 4d1ed

The dependency updates address the reported advisories without functional source changes, so the PR is ready to merge.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the security fixes for js-yaml and brace-expansion and references the related issue.
Description check	✅ Passed	The description directly explains the four security alert fixes, exact version pins, lockfile updates, and verification results.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch andriy/inf-3002-agentql-js-yaml-brace-expansion

---

_{Comment @coderabbitai help to get the list of available commands.}