fix(deps): patch 6 high-severity alerts (brace-expansion, js-yaml, minimatch)

[yacinekahlerras-turbodocx]

What

Resolves all 6 open high-severity Dependabot alerts in this repo — lockfiles only, no manifest change.

Package	Alerts	Was	Now	Advisory
brace-expansion	#17, #35	1.1.12	1.1.16	GHSA-3jxr-9vmj-r5cp
js-yaml	#18, #36	3.14.2	3.15.0	GHSA-52cp-r559-cp3m
minimatch	#3, #21	3.1.2	3.1.5	GHSA-7r86-cg39-jmmj

Each advisory is filed twice — once per lockfile (root and packages/js-sdk) — so both lockfiles are updated. 3 packages × 2 lockfiles = 6 alerts.

Why it's low-risk

• All three are dev-only transitive dependencies of the Jest/ts-jest test toolchain. None is a direct dependency; none appears in any package.json.
• The JS SDK has zero runtime dependencies, so none of this ships to consumers of @turbodocx/sdk (dist/ only).
• No overrides pin was used. Every patched version already satisfies the semver range its consumers declare (minimatch ^3.1.1, brace-expansion ^1.1.x, js-yaml ^3.13.x), so a plain npm update resolves them. That keeps the diff to 21 lines per lockfile and lets future patch releases flow normally instead of freezing the version.

Verification

• npm ci — ✅
• npm run build:js (tsc) — ✅
• npm run test:js — ✅ 271 / 271 passing

Standard change (dependency/security bump) — no Change Request issue per CLAUDE.md.

🤖 Generated with Claude Code

[yacinekahlerras-turbodocx]

🔍 Code review — what was fixed, what was skipped, and why

Verdict: safe to merge

Lockfiles only. No package.json change, no source change, no overrides pin.

What was fixed (6/6 — all open high alerts in this repo)

Package	Alerts	Was → Now	Advisory
brace-expansion	#17, #35	1.1.12 → 1.1.16	GHSA-3jxr-9vmj-r5cp
js-yaml	#18, #36	3.14.2 → 3.15.0	GHSA-52cp-r559-cp3m
minimatch	#3, #21	3.1.2 → 3.1.5	GHSA-7r86-cg39-jmmj

Each advisory is filed twice — once per lockfile (root + packages/js-sdk) — hence 3 packages × 2 lockfiles = 6 alerts. Nothing was skipped in this repo.

The one design decision worth reviewing

My first attempt added an overrides block. I reverted it, because every patched version already satisfies the range its consumers declare:

Package	Consumer requires	Patched version	Satisfies?
minimatch	^3.1.1 (glob, test-exclude)	3.1.5	✅
brace-expansion	^1.1.x	1.1.16	✅
js-yaml	^3.13.x	3.15.0	✅

So a plain npm update resolves all three. Why that's better than an override:

• Diff is 21 lines per lockfile instead of a manifest change plus a forced tree rewrite.
• An exact overrides pin freezes the package — the next patch release would be blocked until someone manually bumps the pin. Staying in-range keeps future security patches flowing automatically.

(Implementation note: npm update inside packages/js-sdk updates the root lockfile, not the workspace member's own — npm resolves to the workspace root. The js-sdk lockfile had to be regenerated standalone, outside the workspace, and copied back. Worth knowing if you regenerate these lockfiles later.)

Why the risk is low

• All three are dev-only transitive deps of the Jest/ts-jest toolchain. None is a direct dependency; none appears in any package.json.
• Per .claude/rules/js-sdk.md, the JS SDK has zero runtime dependencies and publishes dist/ only — none of this reaches a consumer of @turbodocx/sdk.
• Each package resolves to a single major line in this tree, so there's no risk of dragging a consumer across a major.

Verification

Check	Result
npm ci	✅
npm run build:js (tsc)	✅
npm run test:js	✅ 271 / 271
CI — Test JS/Go/Java/Python/Ruby SDK	✅ all pass
CI — CodeQL Analyze (5 languages)	✅ all pass

Not addressed here (intentionally)

Only high-severity alerts were in scope for this pass. The repo's one critical (handlebars) was fixed separately in #46, and its change-request record is #49.

[yacinekahlerras-turbodocx]

✅ Final status — ready to merge

What this fixes — all 6 open high-severity alerts in this repo

Alert	Package	Change	Advisory
#17 #35	brace-expansion	1.1.12 → 1.1.16	GHSA-3jxr-9vmj-r5cp
#18 #36	js-yaml	3.14.2 → 3.15.0	GHSA-52cp-r559-cp3m
#3 #21	minimatch	3.1.2 → 3.1.5	GHSA-7r86-cg39-jmmj

Each advisory is filed twice — once per lockfile (root and packages/js-sdk) — so 3 packages × 2 lockfiles = 6 alerts. Nothing is deferred; this repo is fully cleared of high-severity alerts.

Why the risk is low

• All three are dev-only transitive dependencies of the Jest / ts-jest test toolchain. None is a direct dependency and none appears in any package.json.
• Per .claude/rules/js-sdk.md the JS SDK has zero runtime dependencies and publishes dist/ only — none of this reaches anyone installing @turbodocx/sdk.
• Each resolves to a single major line in this tree, so there's no risk of pulling a consumer across a major version.

The one design decision worth reviewing

My first attempt added an overrides block. I reverted it, because every patched version already satisfies the range its consumers declare:

Package	Consumer requires	Patched version	Satisfies?
minimatch	^3.1.1 (glob, test-exclude)	3.1.5	✅
brace-expansion	^1.1.x	1.1.16	✅
js-yaml	^3.13.x	3.15.0	✅

So a plain npm update resolves all three. Why that's better than a pin: the diff stays at 21 lines per lockfile with no manifest change, and — more importantly — an exact overrides pin freezes the package, blocking the next patch release until a human bumps it again. Staying in-range keeps future security fixes flowing automatically.

🛠️ Implementation note for anyone regenerating these lockfiles later: running npm update inside packages/js-sdk updates the root lockfile, not the workspace member's own — npm resolves up to the workspace root. The packages/js-sdk lockfile had to be regenerated standalone (outside the workspace) and copied back.

Verification

Check	Result
CI	✅ 11/11 — Test JS/Go/Java/Python/Ruby + CodeQL Analyze ×5
npm ci	✅
npm run build:js (tsc)	✅
npm run test:js	✅ 271 / 271

No browser or E2E test was run, deliberately — this is a Node library with no UI, and all three bumps are dev-only test-toolchain dependencies that never ship to consumers. The meaningful question is whether the toolchain still builds and the full suite still passes; 271/271 answers it.

Scope

Only high-severity alerts were in scope for this pass. This repo's one critical (handlebars, GHSA-2w6w-674q-4c4q) was fixed separately in #46, with its change-request record at #49.