fix(js): update vulnerable transitive dependencies

[Siddhant-K-code]

Description

Fixes the JavaScript dependency-audit failure observed in #652 by refreshing compatible transitive versions in pkg/js/package-lock.json:

• brace-expansion: 1.1.18 and 5.0.9
• fast-uri: 3.1.5
• js-yaml: 4.3.1

These are the first compatible versions outside the advisory ranges reported by npm. No direct dependency ranges or runtime code change.

Failing job: https://github.com/openfga/language/actions/runs/32035329850/job/95404310045?pr=652

Testing

Using the CI runtime versions (Node 24.19.0 and npm 11.17.0):

• npm ci
• npm audit — 0 vulnerabilities
• npm run lint
• npm run format:check
• npm run typecheck
• npm run build:light
• npm test -- --runInBand — 666 passed, 27 skipped

[linux-foundation-easycla]

• ✅ login: Siddhant-K-code / name: Siddhant Khare (fdedf0b)
• ❌ - login: @oai-codex / name: Codex. The commit (fdedf0b) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e3435a90-a6fe-494b-b377-1bbbed95ca00

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• pkg/js/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[SoulPancake]

Lets hold these off @Siddhant-K-code
I already have the audit failures in a separate PR #660

Edit : Theres nothing immediately to release in pkg js in develop anyway so we can skip this for the moment

[Siddhant-K-code]

I already have the audit failures in a separate PR #660

We can separate it out as it is not needed to go in same PR!

Edit : Theres nothing immediately to release in pkg js in develop anyway so we can skip this for the moment

It has security fixes & affecting PRs with CI failures

[SoulPancake]

It's not really required in the develop flow, If you want you can add it in main @Siddhant-K-code

[SoulPancake]

It has security fixes & affecting PRs with CI failures

I agree but it won't matter until we release, if you want you can do it on main