fix: bump vulnerable transitive dependencies via resolutions

[jonathannorris]

Summary

• Adds yarn resolutions entries to force patched versions of vulnerable transitive dependencies
• Fixes 9 open Dependabot alerts: brace-expansion, picomatch, flatted, and undici

Package	Old Version	Patched Version	Severity
brace-expansion	1.1.11	1.1.13	medium
brace-expansion	2.0.1, 2.0.2	2.0.3	medium
picomatch	2.3.1	2.3.2	medium
picomatch	4.0.2	4.0.4	medium / high
flatted	3.3.3	3.4.2	high
undici	7.14.0	7.24.6	medium / high

[Copilot]

Pull request overview

This PR addresses Dependabot-reported vulnerabilities by forcing patched versions of several vulnerable transitive dependencies using Yarn resolutions, and updating the lockfile accordingly.

Changes:

• Added Yarn resolutions overrides for brace-expansion, picomatch, flatted, and undici to ensure patched versions are selected.
• Updated yarn.lock to reflect the resolved patched versions and checksums.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Adds resolutions entries to force patched transitive dependency versions.
yarn.lock	Updates locked versions/checksums for the affected transitive dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 7 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The PR description/table lists fixes for brace-expansion, picomatch, flatted, and undici, but this change also introduces new lodash resolutions (and the lockfile moves lodash to 4.18.1). Please either document lodash as part of the security bump (including the versions/alerts being addressed) or drop the lodash resolutions if they’re unintended.

[Copilot]

This adds a lodash resolution, but lodash isn’t mentioned in the PR summary/table of patched dependencies. Please document why lodash is being forced here (which alert/vulnerability it addresses) or remove the resolution if it’s not required.

[Copilot]

This adds a lodash resolution, but lodash isn’t mentioned in the PR summary/table of patched dependencies. Please document why lodash is being forced here (which alert/vulnerability it addresses) or remove the resolution if it’s not required.