fix(deps): resolve API types security alerts

[JOY (JOY)]

Summary

• update the existing brace-expansion override from 2.1.2 to 2.1.4
• refresh the API types lockfile so the existing global js-yaml override removes nested js-yaml@4.1.1
• keep direct js-yaml@4.3.0, openapi-typescript@7.13.0, and Backend runtime dependencies unchanged

Security impact

This closes the vulnerable dependency paths for:

• GHSA-52cp-r559-cp3m / CVE-2026-59869, High
• GHSA-h67p-54hq-rp68 / CVE-2026-53550, Moderate
• current npm audit findings for brace-expansion@2.1.2

Verification

• RED: clean install audit reported the vulnerable nested js-yaml and brace-expansion paths
• GREEN: npm ci --ignore-scripts passed
• npm audit --audit-level=low: 0 vulnerabilities
• dependency tree: only js-yaml@4.3.0; brace-expansion@2.1.4 overridden
• js-yaml merge-key runtime smoke passed
• openapi-typescript in-memory schema smoke passed
• git diff --check passed
• independent review: 0 Critical, 0 Important, 0 Minor

Baseline note

The package's standalone typecheck requires generated dist files, and its full build requires the Elixir mix tool. Those were not available on the clean local checkout, so validation uses clean dependency installation, audit, dependency-tree checks, runtime parser smokes, and repository CI.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.