[JohnMcLear]

Clears all open Dependabot security alerts on this repo. Both are development-scope transitive dependencies coming in through pnpm-lock.yaml, not from any direct dependency, so the fix is a pnpm.overrides entry plus a regenerated lockfile.

alert	severity	package	scope	was	now
#47	high	js-yaml	development	4.1.1	4.3.2
#46	high	js-yaml	development	4.1.1	4.3.2
#39	high	brace-expansion	development	1.1.14	1.1.21
#38	high	js-yaml	development	4.1.1	4.3.2
#37	medium	js-yaml	development	4.1.1	4.3.2

5 alerts closed: 4 high, 1 medium.

Notes

• pnpm update --recursive --latest does not move either package, because neither is a direct dependency — hence the overrides.
• js-yaml is overridden to ^4.3.2 rather than >=4.3.2 so it stays on the 4.x line (js-yaml 5.x would break eslint 8).
• The brace-expansion override is scoped to the 1.x line (brace-expansion@1) so that minimatch 10's brace-expansion 5.0.12 resolution is left alone.
• Diff is limited to the lockfile plus the overrides block. No unrelated dependency bumps.
• pnpm run lint passes with 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Pin secure transitive development dependencies with pnpm overrides

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Forces patched js-yaml and brace-expansion versions across transitive development dependency
 paths.
• Scopes brace-expansion override to 1.x, preserving newer major resolutions.
• Regenerates pnpm lock data to close five Dependabot security alerts.

Diagram

graph TD
  P["package.json"] --> R["pnpm resolver"] --> L["pnpm-lock.yaml"]
  E["ESLint tree"] --> Y["js-yaml 4.3.2"]
  E --> M["minimatch 3"] --> B["brace-expansion 1.1.21"]
  R --> Y
  R --> B

Loading

High-Level Assessment

The scoped pnpm overrides are the most targeted approach because both vulnerabilities occur only in transitive development dependencies. Upgrading parent tooling could eventually replace these dependency paths, but would introduce an unrelated ESLint migration and greater compatibility risk; direct dependency declarations would misrepresent package ownership.

Files changed (2) +16 / -14

Other (2) +16 / -14

package.jsonAdd security overrides for vulnerable transitive dependencies +6/-0

Add security overrides for vulnerable transitive dependencies

• Adds pnpm overrides requiring js-yaml 4.3.2 or newer within 4.x and patched brace-expansion 1.x releases. The package-qualified brace-expansion rule avoids changing the independently resolved 5.x line.

package.json

pnpm-lock.yamlRegenerate lockfile with patched transitive versions +10/-14

Regenerate lockfile with patched transitive versions

• Records the new overrides and replaces js-yaml 4.1.1 with 4.3.2 and brace-expansion 1.1.14 with 1.1.21. Existing brace-expansion 5.0.12 resolution remains unchanged.

pnpm-lock.yaml