chore(deps/js): resolve npm audit vulnerabilities

[SoulPancake]

Bumps js-yaml to ^4.3.0, clearing the 26 high severity advisories that are currently failing make audit-js on main.

Summary by CodeRabbit

• Chores
  • Updated package configuration to use newer dependency versions.
  • Added an override for brace-expansion to improve dependency consistency.

[dosubot]

📄 Knowledge review

Dosu skipped reviewing this PR because your organization has used its 200 included credits for the month. Your usage will reset on 2026-08-01. To have Dosu review this PR before then, ask your organization admin to upgrade to a pro account.

---

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b1eaa634-392c-4cc9-9114-af5522cc4cfa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The JavaScript package override configuration updates js-yaml to ^4.3.0 and adds a brace-expansion override pinned to ^5.0.9.

Changes

JavaScript dependency overrides

Layer / File(s)	Summary
Override configuration pkg/js/package.json	Updates the js-yaml override and adds the brace-expansion override.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: aaguiarz, copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies JavaScript dependency updates that resolve npm audit vulnerabilities.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/npm-audit-vulnerabilities

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the JavaScript package’s dependency overrides to address npm audit findings in pkg/js/, bringing the JS workspace back to a clean security/audit state.

Changes:

• Bump the js-yaml override from ^4.2.0 to ^4.3.0.
• Add a brace-expansion override at ^5.0.9 to eliminate vulnerable transitive versions and update the lockfile accordingly.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pkg/js/package.json	Updates overrides to newer js-yaml and introduces brace-expansion override for audit remediation.
pkg/js/package-lock.json	Reflects resolved dependency tree changes from the overrides (removes older nested vulnerable copies and pins updated versions).

Files not reviewed (1)

• pkg/js/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/js/package.json`:
- Line 56: Update the dependency configuration around brace-expansion and the
minimatch@3 consumers so brace-expansion@5 is not forced onto minimatch@3, which
requires a callable CommonJS export. Upgrade all affected minimatch consumers
together, or use an override/patch that preserves the callable API while
retaining compatibility.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d275fea8-7acb-4c8f-b93c-cb2c79e2f7b1

📥 Commits

Reviewing files that changed from the base of the PR and between 83fedf8 and 8bfa07e.

⛔ Files ignored due to path filters (1)

• pkg/js/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• pkg/js/package.json

[Siddhant-K-code]

Please update PR description before merge! We are just bumping js-yaml

[SoulPancake]

CC: @Siddhant-K-code
You can update this if you want

[Siddhant-K-code]

I prepared the requested refresh in #663. It merges the current main fixes into this branch and raises the js-yaml override to ^4.3.1; the JS audit, lint, formatting, typecheck/build, and tests all pass. Direct push access to this upstream branch was unavailable, so merging #663 will update this PR.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: Siddhant-K-code / name: Siddhant Khare (7404696, bf63220)
• ✅ login: SoulPancake / name: Anurag Bandyopadhyay (f9525d0)
• ✅ login: SoulPancake / name: SoulPancake (6627b6a, 8bfa07e)
• ✅ login: dependabot[bot] / name: dependabot[bot] (bf63220)

[Siddhant-K-code]

/easycla