chore(deps): update deps with reported vulns

[rvagg]

No description provided.

[github-actions]

depsound · 7 dependency changes · flags to look at now

• npm:brace-expansion 1.1.12 → 1.1.16: provenance anomaly (account-takeover shape): claimed repo != source repo; generated code changed (dist/commonjs/index.js, +/-263 lines): outside the review surface, worth a look; 1 known vulnerability(ies) still present after the bump: CVE-2026-14257; fixes 2 advisory(ies)
• npm:fast-uri 3.0.6 → 3.1.4: provenance anomaly (account-takeover shape): publisher changed; fixes 4 advisory(ies)
• npm:minimatch 3.1.2 → 3.1.5: provenance anomaly (account-takeover shape): claimed repo != source repo; fixes 3 advisory(ies)
• npm:picomatch 2.3.1 → 2.3.2: provenance anomaly (account-takeover shape): publisher changed; fixes 2 advisory(ies)
• npm:js-yaml 4.1.0 → 4.3.0: generated code changed (dist/js-yaml.js, +/-6,783 lines): outside the review surface, worth a look; hooks that run only for a git/link/file dependency: prepack added (git/non-registry installs only); a registry install does not run these; fixes 3 advisory(ies)
• new dependency npm:ajv 6.15.0: adopting 92 files, whole footprint unreviewed; largest unreviewed file dist/ajv.bundle.js
• npm:flatted 3.3.3 → 3.4.3: fixes 2 advisory(ies) · 12 files +466/-108 · no install/build execution surface

Checked: the published artifact diff, manifest compatibility, install/build execution surface. Not checked: runtime behaviour, intent (an obfuscated payload reads as ordinary code), whether your code reaches the change, your test coverage.

Continue locally, the full per-file analysis and a grep-able workspace (trees + stats.json) are available for agent investigation:

printf '%s\n' \
  'npm:brace-expansion 1.1.12 1.1.16' \
  'npm:fast-uri 3.0.6 3.1.4' \
  'npm:flatted 3.3.3 3.4.3' \
  'npm:js-yaml 4.1.0 4.3.0' \
  'npm:minimatch 3.1.2 3.1.5' \
  'npm:picomatch 2.3.1 2.3.2' \
  'npm:ajv 6.15.0' \
  | go run github.com/rvagg/depsound/cmd/depsound@v0.34.0 bulk

Or hand this PR to an agent: point it at the PR and the review skill for a proceed/hold call.

_{depsound · full report + logs}