chore(deps): clear Dependabot security alerts

[JohnMcLear]

Clears all 5 open Dependabot alerts on this repo. All are transitive, development-scope only (they arrive via eslint / minimatch), so nothing user-facing changes.

severity	package	first patched
high	js-yaml	4.3.2
high	js-yaml	4.3.1
high	brace-expansion	1.1.16
high	js-yaml	4.3.0
medium	js-yaml	4.2.0

pnpm update js-yaml brace-expansion --recursive --latest does not move them (neither is a direct dependency and the parents' ranges stay satisfied), so this adds scoped pnpm.overrides and regenerates pnpm-lock.yaml:

• js-yaml@^4 → >=4.3.2 <5 (lock: 4.1.1 → 4.3.2)
• brace-expansion@^1 → >=1.1.16 <2 (lock: 1.1.14 → 1.1.21)

The overrides are version-scoped, so the already-patched brace-expansion@5.x / js-yaml@5.x branches of the tree are untouched. No other package versions change; pnpm audit goes from 5 advisories to 0 and pnpm run lint passes with 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Patch vulnerable transitive development dependencies

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Adds scoped pnpm overrides for vulnerable development-only transitive dependencies.
• Resolves js-yaml 4.x and brace-expansion 1.x to patched releases.
• Regenerates the lockfile while preserving unaffected major-version branches.

Diagram

graph TD
  A["package.json"] --> B["pnpm Overrides"] --> C["pnpm-lock.yaml"]
  B --> D["ESLint Tree"] --> E["js-yaml 4.3.2"]
  B --> F["Minimatch Tree"] --> G["brace-expansion 1.1.21"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Upgrade parent tooling packages

• ➕ Could eliminate overrides by adopting upstream dependency resolutions.
• ➕ Reduces long-term override maintenance when compatible releases exist.
• ➖ Introduces broader ESLint and plugin changes unrelated to the alerts.
• ➖ May require major upgrades or still retain vulnerable transitive resolutions.

Recommendation: Keep the version-scoped pnpm overrides. They provide the narrowest remediation for transitive development dependencies, preserve already-safe major branches, and avoid unrelated toolchain churn. Remove them later when parent tooling resolves these patched versions naturally.

Files changed (2) +111 / -119

Other (2) +111 / -119

package.jsonAdd scoped overrides for vulnerable transitive packages +6/-0

Add scoped overrides for vulnerable transitive packages

• Adds pnpm overrides requiring js-yaml 4.x releases at or above 4.3.2 and brace-expansion 1.x releases at or above 1.1.16. Upper bounds prevent the overrides from affecting newer major branches.

package.json

pnpm-lock.yamlResolve transitive dependencies to patched versions +105/-119

Resolve transitive dependencies to patched versions

• Records the new overrides and resolves js-yaml to 4.3.2 and brace-expansion to 1.1.21. Removes superseded vulnerable snapshots and normalizes optional peer-resolution metadata without changing other package versions.

pnpm-lock.yaml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗