Patch js-yaml and brace-expansion DoS advisories

[uncleJim21]

Closes the two remaining high-severity Dependabot alerts. Both are follow-on advisories published after the versions PR #136 landed on, so the floors it set no longer clear them.

Deliberately minimal: 3 lines in package.json, 4 packages in the lockfile.

js-yaml 4.3.0 → 4.3.1 — GHSA-5p4m-2wfm-xmqj (high, #121)

Quadratic CPU consumption in !!omap resolution. The 5.x fix for CVE-2026-59870 was never backported, so 4.3.0 — the newest 4.x when #136 shipped — was still affected.

Two things make this the more serious of the pair:

• !!omap is registered in the default schema, so a plain yaml.load() with no options is enough. No custom schema required.
• The loop is synchronous, so a single request blocks the event loop for the whole process — amplification is per-process, not per-request.

It also reaches the runtime tree via @langchain/community → @langchain/classic, not just devDependencies.

brace-expansion 1.1.17 → 1.1.18, 2.1.3 → 2.1.4 — GHSA-rgw5-rvv9-x895 (high, #119)

DoS via unbounded intermediate arrays, explicitly bypassing the CVE-2026-14257 mitigation we picked up in #136.

Lower practical risk — reachable only through build tooling, operating on glob patterns from our own source tree, never user input:

1.1.17  swagger-autogen -> glob@7 -> minimatch@3.1.5      (codegen)
2.1.3   archiver -> archiver-utils/readdir-glob -> minimatch   (dev only)

Why the diff is this small

Every consumer already uses a caret range (js-yaml ^4.1.1, brace-expansion ^1.1.7 / ^2.0.2), so:

• js-yaml needed only the root bump — npm dedupes 4.3.1 across @langchain/* on its own
• brace-expansion needed only its two existing override floors raised

No new overrides, no dependency additions, no move to js-yaml 5.x (still on the 4.x line). Four packages change in the lockfile and nothing else:

js-yaml:                                      4.3.0  -> 4.3.1
brace-expansion:                              1.1.17 -> 1.1.18
archiver-utils/node_modules/brace-expansion:  2.1.3  -> 2.1.4
readdir-glob/node_modules/brace-expansion:    2.1.3  -> 2.1.4

Verification

• npm audit: 0 critical, 0 high (was 1 high). 3 lows remain, all the unfixable bolt11 → secp256k1 → elliptic chain
• npm ci succeeds — package.json and lockfile in sync, so CI and the Docker build stay green
• npm run skills:build succeeds (js-yaml is its main consumer); zap-validator, reranker and relay-pool suites pass; canvas/sharp/secp256k1 rebuild cleanly
• Both patched versions predate the quarantine window by ~22 days, so this installed with min-release-age fully enforced — no bypass

After merge

One alert remains: #23 elliptic (low). No patched version exists — 6.6.1 is latest, reached via bolt11 → secp256k1 → elliptic. Recommend dismissing it as "no fix available" so the queue reads clean.

🤖 Generated with Claude Code