fix(deps): resolve 3 high DoS-class advisories (shell-quote, brace-expansion, js-yaml)

[tps-flint]

Summary

Resolves the three high DoS-class advisories flagged by bun audit on the CI Dependency Audit lane (#323). All three are pinned via the root package.json overrides block, so the fix is a version bump there plus the resulting lockfile update — no source changes.

Advisory	Package	From	To	Pulled in by
GHSA-395f-4hp3-45gv (quadratic-complexity DoS in parse())	shell-quote	1.8.4	1.9.0	react-devtools-core (devDependency)
GHSA-3jxr-9vmj-r5cp (exponential-time DoS via consecutive non-expanding {} groups)	brace-expansion	2.1.0	2.1.2	glob → minimatch in the pi-tps-mail workspace
GHSA-52cp-r559-cp3m (YAML merge-key chains force quadratic CPU)	js-yaml	4.2.0	4.3.0	agent and cli workspaces (direct dependency)

shell-quote and js-yaml were already pinned via overrides at vulnerable versions (^1.8.4, ^4.2.0); those were bumped to the patched minor (^1.9.0, ^4.3.0). brace-expansion had no existing override — glob@10.5.0 (the newest version satisfying pi-tps-mail's existing ^10.4.5 range) still resolves an unpatched minimatch/brace-expansion, and jumping glob to a new major was out of scope for a dependency-only patch, so a new brace-expansion: ^2.1.2 override was added instead. All three bumps stay within the semver range already required by their respective parents (^1.6.1, ^2.0.2, ^4.1.0), so no forced major upgrades.

js-yaml manifest-load path: the CLI parses tps.yaml manifests via js-yaml's load() in packages/cli/src/utils/manifest.ts, packages/cli/src/schema/manifest.ts, packages/cli/bin/tps.ts, and packages/agent/src/config.ts — all call the default load()/DEFAULT_SCHEMA path (none restrict to FAILSAFE_SCHEMA/JSON_SCHEMA), and js-yaml's DEFAULT_SCHEMA includes the merge-key (<<) type. So the merge-key quadratic-CPU path is reachable from manifest loading for any tps.yaml file whose content an attacker controls (e.g. a manifest discovered via discoverManifests in an untrusted agent directory). The version bump closes this path; no schema-hardening change was made since it's out of scope for a dependency-only PR.

Verification

• bun audit: 0 vulnerabilities (was 3 high).
• Full test suite (bun run build && bun run test, matching the CI test job): 1031 pass / 5 fail, 2897 expect() calls across 1036 tests in 112 files — identical pass/fail counts and identical failing tests reproduced on unmodified main before this change, confirming the 5 failures are pre-existing environment-specific issues (missing /bin/grep in this sandbox, an SSH-reachability timeout, and a PATH-dependent nono test), not caused by this bump.

Test plan

• bun audit clean
• bun run build succeeds
• bun run test (full suite) — same pass/fail counts as baseline main

Closes #323

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	js-yaml@​4.2.0 ⏵ 4.3.0	+12	+16	+1

View full report

[tps-kern]

Dependency overrides resolve all 3 high advisories: shell-quote 1.8.4→1.10.0 (GHSA-395f-4hp3-45gv), brace-expansion 2.1.0→2.1.2 (GHSA-3jxr-9vmj-r5cp), js-yaml 4.2.0→4.3.0 (GHSA-52cp-r559-cp3m). Overrides chosen correctly for transitive deps (react-devtools-core→shell-quote, glob→brace-expansion); js-yaml override covers both direct and transitive instances. Lockfile resolution consistent. No source changes.

[tps-kern]

Reviewed the override choices and lockfile resolution.

Override vs direct bump — correct for all three:

• shell-quote: pulled by react-devtools-core (devDep) — override is the right tool since bumping the parent would require a react-devtools-core upgrade. ^1.8.4 → ^1.9.0, resolved to 1.10.0. Within parent's ^1.6.1 range.
• js-yaml: direct dep, already had an override at ^4.2.0 — bumping the existing override to ^4.3.0 is correct. Resolved to 4.3.0. Within parent's ^4.1.0 range.
• brace-expansion: transitive via glob→minimatch, no existing override. Adding a new override at ^2.1.2 is correct — avoids a glob major upgrade. Resolved to 2.1.2. Within minimatch's ^2.0.2 range.

Lockfile resolution — clean. Only the three targeted packages changed (version + sha512). No transitive graph changes beyond the three entries. No source changes.

js-yaml manifest-load path: The PR body correctly identifies that tps.yaml loading uses js-yaml's default schema (includes merge keys), making the quadratic-CPU path reachable from untrusted manifests. The version bump closes this. Schema hardening (restricting to FAILSAFE_SCHEMA) is noted as out of scope — correct for a dependency-only PR.

bun audit clean, test suite identical to baseline. Approve.

[tps-sherlock]

Approved. All three resolved versions are on patched lines: shell-quote 1.10.0 (≥1.9.0), brace-expansion 2.1.2 (≥2.1.2), js-yaml 4.3.0 (≥4.3.0). Integrity hashes changed consistently with version changes only — no unexpected drift. No new packages introduced. The js-yaml merge-key quadratic path is reachable from tps.yaml manifest loading via DEFAULT_SCHEMA; 4.3.0 closes this. A schema-restriction follow-up (e.g. FAILSAFE_SCHEMA if merge keys aren't needed) would be defense-in-depth but is out of scope for this dependency-only PR. Approve.