chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped brace-expansion to 2.1.2 to resolve high-severity DoS vulnerability (CVE-2026-13149)

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#67	brace-expansion	high	Bumped to 2.1.2 via yarn resolution >=2.1.2 <3

brace-expansion is a transitive dependency via minimatch. A yarn resolutions entry forces the patched version. The bounded range (<3) keeps within the same major version to avoid breaking changes.

All existing tests pass.

[Copilot]

Pull request overview

Resolves a Dependabot high-severity security alert by forcing a patched brace-expansion version via Yarn resolutions, ensuring the transitive dependency (via minimatch) is upgraded without introducing a major-version jump.

Changes:

• Added a Yarn resolutions constraint for brace-expansion to >=2.1.2 <3.
• Updated yarn.lock to lock brace-expansion to 2.1.2 (including updated checksum).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds a resolutions entry to enforce patched brace-expansion version range.
yarn.lock	Locks brace-expansion to 2.1.2 consistent with the new resolution.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.