chore(deps): clear Dependabot security alerts

[JohnMcLear]

Clears all open Dependabot security alerts on this repo. Every one is a
development-scope transitive dependency pulled in through pnpm-lock.yaml
(via eslint / @eslint/eslintrc and minimatch@3), not a direct dependency,
so the fix is to force the patched versions rather than edit dependencies.

pnpm update js-yaml brace-expansion --recursive --latest does not move
transitive-only packages, so this uses major-scoped pnpm.overrides:

"pnpm": { "overrides": { "js-yaml@4": "^4.3.2", "brace-expansion@1": "^1.1.16" } }

Scoping to the affected major line matters: an unbounded >=4.3.2 / >=1.1.16
drags eslint's js-yaml to 5.x and minimatch@3's brace-expansion to 5.x.
With the ranges above, resolution is:

package	before	after
js-yaml (eslint 8.57.1, @eslint/eslintrc 2.1.4)	4.1.1	4.3.2
js-yaml (mocha 12)	5.4.1	5.4.1 (untouched)
brace-expansion (minimatch 3.1.5)	1.1.14	1.1.21
brace-expansion (minimatch 10.2.6)	5.0.12	5.0.12 (untouched)

Alerts closed

#	severity	package	scope	first patched
45	high	js-yaml	development	4.3.2
44	high	js-yaml	development	4.3.1
37	high	brace-expansion	development	1.1.16
36	high	js-yaml	development	4.3.0
35	medium	js-yaml	development	4.2.0

4 high, 1 medium.

pnpm run lint passes with 0 errors. Dev-scope only - no user-facing change.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Pin patched transitive development dependencies with pnpm overrides

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Adds major-scoped overrides for vulnerable transitive development dependencies.
• Upgrades affected js-yaml and brace-expansion versions without moving newer major lines.
• Regenerates the lockfile to clear five Dependabot security alerts.

Diagram

graph TD
  P["package.json"] -->|defines overrides| R["pnpm resolver"] -->|generates| L["pnpm-lock.yaml"]
  E["ESLint toolchain"] -->|loads| J["js-yaml 4.3.2"]
  M["minimatch 3.1.5"] -->|loads| B["brace-expansion 1.1.21"]
  L -->|pins version| J
  L -->|pins version| B

Loading

High-Level Assessment

The major-scoped pnpm overrides are the appropriate approach for transitive-only vulnerabilities that recursive updates cannot move. Scoping by major version avoids incompatible upgrades to js-yaml 5 and brace-expansion 5; upgrading parent tooling would be broader and unnecessary for this remediation.

Files changed (2) +16 / -14

Other (2) +16 / -14

package.jsonAdd scoped overrides for vulnerable transitive packages +6/-0

Add scoped overrides for vulnerable transitive packages

• Adds pnpm overrides for js-yaml 4 and brace-expansion 1, forcing patched releases while leaving other major lines unchanged.

package.json

pnpm-lock.yamlResolve patched js-yaml and brace-expansion versions +10/-14

Resolve patched js-yaml and brace-expansion versions

• Records the new overrides and replaces js-yaml 4.1.1 with 4.3.2 and brace-expansion 1.1.14 with 1.1.21 in affected development dependency snapshots. Existing major-version 5 resolutions remain unchanged.

pnpm-lock.yaml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗