chore(deps): override brace-expansion and js-yaml

[ar2rsawseen]

Both advisories reach this repo only through devDependencies, so nothing that ships to SDK consumers is affected. overrides in a published package's manifest applies to this repo's own installs, not to downstream projects.

Package	Advisory	Found	Pinned
brace-expansion	GHSA-3jxr-9vmj-r5cp	1.1.12 (top level), 2.0.2 (under mocha)	^1.1.16, ^2.1.2
js-yaml	GHSA-52cp-r559-cp3m	3.14.1 (top level, via eslint), 4.1.0 (under mocha)	^3.15.0, ^4.3.0

Each advisory patches its major lines separately, so both packages get one range-keyed override per major rather than forcing a single version across a major boundary.

Resolution

Lockfile changes are confined to these two packages; no other version moved:

• brace-expansion 1.1.12 → 1.1.18, and 2.0.2 → 2.1.4 under mocha
• js-yaml 3.14.1 → 3.15.1, and 4.1.0 → 4.3.1 under mocha

Both files keep their existing CRLF line endings, so the diff is only the changed entries.

Verification

• npm ci succeeds (449 packages).
• Re-scanned the lockfile against the advisory version ranges: 0 remaining matches.
• eslint --ignore-path .eslintignore . — the pretest step, which consumes both packages — passes clean.
• Full mocha suite: 94 passing.

Targets staging, matching how this repo takes changes.

🤖 Generated with Claude Code