fix: fix security vulnerabilities

[pviti]

Fix security vulnerabilities

Closes #207

Resolves the open Dependabot/Vanta alerts on this repo, plus the remaining advisories surfaced by pnpm audit.

Why a new PR: these changes were originally pushed to update-dependencies after #209 had already been merged, so they never reached main. GitHub does not reopen a merged PR when new commits land on its branch, which left the fix stranded on the branch while all five alerts stayed open.

Alerts closed by this PR

Alert	Severity	Package	Vulnerable range	Fixed version here
#149	High	brace-expansion	>= 4.0.0, < 5.0.8 (CVE-2026-14257)	5.0.9
#150	High	brace-expansion	>= 2.0.0, < 2.1.3 (CVE-2026-14257)	2.1.4
#156	High	brace-expansion	>= 4.0.0, < 5.0.9 (CVE-2026-69152)	5.0.9
#168	High	brace-expansion	>= 2.0.0, < 2.1.4	2.1.4
#165	High	js-yaml	>= 3.0.0, < 3.15.1 (GHSA-5p4m-2wfm-xmqj)	3.15.1

Issue #207 tracks alerts 149, 150, 156 and 165, with the earliest remediation deadline on 2026-08-31.

Additional advisories from pnpm audit

Severity	Package	Issue	Path	Fix
High	js-yaml 4.3.0	same !!omap DoS	mocha, semantic-release	lockfile refresh -> 4.3.1
High	undici 7.28.0	cross-user information disclosure and parse-time crash via degenerate private cache directives	@semantic-release/github	lockfile refresh -> 7.29.0
Moderate	undici 6.27.0 / 7.28.0	response desynchronization via retry interceptor, CRLF injection via blob-like body type, cookie attribute injection, cache-directive disclosure	@actions/http-client, @semantic-release/github	lockfile refresh -> 6.28.0 / 7.29.0
High	serialize-javascript 6.0.2	RCE via RegExp.flags / Date.prototype.toISOString(), plus CPU-exhaustion DoS	mocha	override -> 7.1.0

How each one is fixed

Lockfile refresh (no override needed). For js-yaml, brace-expansion and undici every dependent already declares a range that admits the patched release — ^3.14.1, ^4.1.0, ^2.0.1, ^5.0.x, ^6.23.0, ^7.0.0 — so regenerating pnpm-lock.yaml is enough. No package.json change is required. The undici advisories are dev-only in any case: both copies come in through semantic-release, which only runs in CI.

Override. serialize-javascript is the one exception: mocha still pins ^6.0.2 and the fix landed in 7.0.5, so the range cannot resolve to a patched version. It is declared in pnpm-workspace.yaml, since pnpm 11 no longer reads pnpm.overrides from package.json. The entry is scoped to the vulnerable range only (serialize-javascript@<7.0.5) and carries a comment with the reason, so it drops out naturally once mocha ships a fix.

The bump is dev-only — mocha uses the package for parallel-mode worker serialization — and v7 requires Node >= 20, which matches this package's engines.

Verification

• pnpm audit — no advisories
• No vulnerable copies left in the lockfile: only brace-expansion 2.1.4 / 5.0.9 and js-yaml 3.15.1 / 4.3.1 remain
• pnpm build, pnpm test (27 passing), pnpm lint (biome, 67 files) — all pass
• CLI smoke-tested via ./bin/run.js: --version and applications run against the local config

[pviti]

🎉 This PR is included in version 6.9.7 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀