[AAASM-4971] ⬆️ (deps): website js-yaml 4.3.0 + brace-expansion 1.1.16/5.0.7

[Chisanan232]

Target

• Task summary:

  Remediate two Dependabot DoS advisories affecting dev/build-only
  transitive dependencies of the standalone Docusaurus website/. Neither
  package ships in the published @agent-assembly/sdk — the SDK's own tree
  (root lockfile) is already patched and is not touched here.

• Task tickets:

  • Task ID: AAASM-4971
  • Relative task IDs:
    • N/A (single advisory-group ticket -> single PR).
  • Relative PRs:
    • N/A.

• Key point change (optional):

  Package	Advisory / CVE	Affected range	Resolved	Consumer
  js-yaml	GHSA-52cp-r559-cp3m / CVE-2026-59869	>= 4.0.0, < 4.3.0	4.2.0 -> 4.3.0	Docusaurus core, gray-matter, cosmiconfig
  brace-expansion	GHSA-3jxr-9vmj-r5cp / CVE-2026-13149	< 1.1.16	1.1.14 -> 1.1.16	minimatch@3.1.5
  brace-expansion	GHSA-3jxr-9vmj-r5cp / CVE-2026-13149	>= 3.0.0, < 5.0.7	5.0.5 -> 5.0.7	minimatch@10.2.5

  All three are indirect/transitive deps reached only through the docs
  site's build toolchain (Docusaurus). They are unreachable from any SDK
  runtime path. js-yaml 3.x (3.15.0) is outside the advisory range and is
  left untouched.

Effecting Scope

• Action Types:

  • 🍀 Improving something (performance, code quality, security, etc.)
    • 🟢 No breaking change

• Scopes:

  • 🚀 Building
    • 🔗 Dependencies
  • 📚 Documentation (the website/ app only)

• Additional description:

  Applied as pnpm.overrides in website/package.json, regenerated with
  pnpm 10 (pnpm 11 triggers ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on this
  lockfile). Only website/package.json + website/pnpm-lock.yaml change.

Description

• Exact overrides changed (website/package.json -> pnpm.overrides):

  • js-yaml@^4.0.0: ^4.2.0 -> ^4.3.0
  • added brace-expansion@1: ^1.1.16
  • added brace-expansion@5: ^5.0.7

• Why ^ and not a bare >=: this repo's CLAUDE.md pinning rule forbids
  a bare >= because it lets the resolver pull an unwanted major. Confirmed
  empirically here: brace-expansion@1: ">=1.1.16" bled the 1.x consumer
  (minimatch@3.1.5) across the major boundary and deduped it to the
  still-unpatched 5.0.5, leaving alert Bump eslint from 10.4.0 to 10.4.1 #61 unresolved. The scoped
  ^1.1.16 / ^5.0.7 form keeps each consumer on its own patched line
  (minimatch@3.1.5 -> 1.1.16, minimatch@10.2.5 -> 5.0.7) with no major jump.
  This is the minimal correct form that satisfies the security goal.

• Compat impact: none. Both bumps are patch/minor within their existing
  major lines; no API surface changes; no unrelated packages re-resolved (the
  lockfile diff touches only these two package trees).

• Reachability: dev/build-time only, docs-website scope. The published SDK
  is unaffected — the root pnpm-lock.yaml was already patched and is not
  modified by this PR.

• Builds executed (pnpm 10, --ignore-workspace per the standalone
  website/ gotcha):

  • pnpm install --frozen-lockfile — passes (lockfile integrity consistent).
  • pnpm build (Docusaurus production build) — [SUCCESS] Generated static files in "build".
  • No vulnerable residuals remain in website/pnpm-lock.yaml
    (js-yaml@4.2.0, brace-expansion@1.1.14, brace-expansion@5.0.5 all gone).

• Dependabot alerts: this closes Bump eslint from 10.4.0 to 10.4.1 #61, Bump typescript-eslint from 8.59.4 to 8.60.0 #62, [AAASM-2314] 🔧 (npm): Bump root + 4 runtime sub-packages to 0.0.1-alpha.3 #63 (all
  manifest_path: website/pnpm-lock.yaml). They auto-close once this lands on
  the default branch and Dependabot re-scans master.

Closes AAASM-4971

🤖 Generated with Claude Code

[Chisanan232]

🤖 Claude Code review

Scope: dev/build-only DoS remediation in the standalone Docusaurus website/. Root SDK lockfile untouched (git status = only website/package.json + website/pnpm-lock.yaml).

Advisories resolved

Alert	Package	GHSA / CVE	Vulnerable range	Now
#63	js-yaml	GHSA-52cp-r559-cp3m / CVE-2026-59869	>= 4.0.0, < 4.3.0	4.3.0 ✅
#62	brace-expansion	GHSA-3jxr-9vmj-r5cp / CVE-2026-13149	< 1.1.16	1.1.16 ✅
#61	brace-expansion	GHSA-3jxr-9vmj-r5cp / CVE-2026-13149	>= 3.0.0, < 5.0.7	5.0.7 ✅

Lockfile evidence (website/pnpm-lock.yaml)

js-yaml@3.15.0      (unchanged — outside advisory range)
js-yaml@4.3.0       (was 4.2.0)
brace-expansion@1.1.16   <- minimatch@3.1.5   (was 1.1.14)
brace-expansion@5.0.7    <- minimatch@10.2.5  (was 5.0.5)

Residual grep for js-yaml@4.2.0 | brace-expansion@1.1.14 | brace-expansion@5.0.5 -> none.

Overrides diff (website/package.json)

-      "js-yaml@^4.0.0": "^4.2.0",
+      "js-yaml@^4.0.0": "^4.3.0",
       "js-yaml@3": "^3.15.0",
+      "brace-expansion@1": "^1.1.16",
+      "brace-expansion@5": "^5.0.7",

Footgun caught: the ticket's first-draft bare >=1.1.16 on the @1 key force-resolved minimatch@3.1.5 across the major boundary to the unpatched 5.0.5 (alert #61 would have stayed open). Switched to scoped ^ per the repo's documented pinning rule — each tree stays on its own patched line, no major jump.

Validation (pnpm 10, --ignore-workspace)

• pnpm install --frozen-lockfile — ✅ lockfile consistent
• pnpm build — ✅ [SUCCESS] Generated static files in "build"

Regenerated with pnpm 10 (pnpm 11 -> ERR_PNPM_LOCKFILE_CONFIG_MISMATCH). Alerts #61/#62/#63 auto-close once merged to master.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!