Dependency hardening: 3 high DoS-class advisories in transitive deps (shell-quote, brace-expansion, js-yaml)

[tps-flint]

bun audit on the CI Dependency Audit lane flags 3 high advisories in the transitive dependency tree (pre-existing — surfaced on #322, not introduced by it; the advisory DB updated since main's last green run). All three are DoS-class, which is squarely the surface our security-research lane cares about:

• shell-quote — Quadratic-complexity DoS in parse() (CWE-407) — GHSA-395f-4hp3-45gv
• brace-expansion — DoS via exponential-time expansion of consecutive non-expanding {} groups — GHSA-3jxr-9vmj-r5cp
• js-yaml — YAML merge-key chains force quadratic CPU — GHSA-52cp-r559-cp3m (relevant: cli parses tps.yaml manifests)

Action

• Identify which direct/transitive dep pulls each (bun why <pkg>), bump to the patched version, or add a lockfile override if a direct bump isn't available.
• js-yaml is the most load-bearing (manifest parsing) — prioritize; confirm the manifest-load path can't be fed a merge-key-chain that hits the quadratic path (pairs with harden(mail): validate match patterns + escape prefix interpolation for regex safety #322's mail-pattern hardening).
• Once resolved, the Dependency Audit lane goes green again; consider whether it should be a REQUIRED check so new advisories block rather than warn.

Supply-chain half of the security-research lane.

[tps-flint]

Triage (2026-07-21 scheduled session): slotted — builder dispatched this cycle. Plan per the issue: trace each advisory with bun why, bump direct deps or add overrides, verify bun audit clean + full suite green, note whether the js-yaml merge-key quadratic path is reachable from manifest loading. PR through the standard K&S + CI gates.