Bump npm dependencies to resolve security alerts

[Zendesk-Pooja]

cc: @zendesk/compass

Description

Resolves 2 open Dependabot security alerts by running npm audit fix, which bumped brace-expansion and js-yaml to patched versions across the full dependency tree. Verified via npm ls that every resolved instance — top-level and transitive — now meets the minimum patched version.

Also added js-yaml and brace-expansion as explicit entries in the existing overrides block in package.json (which already pins diff and serialize-javascript), to make the patched pin durable against a future npm install silently re-resolving to a vulnerable version. brace-expansion resolves to two different major versions in this tree — 1.1.18 at the top level, and 2.1.4 nested under mocha → minimatch — so both are pinned explicitly via npm's nested-override key syntax rather than force-collapsing one onto the other.

Also checked .github/workflows/claude.yml and .github/workflows/claude-auto-review.yml for the exact string us.anthropic.claude-sonnet-4-20250514-v1:0 per the linked task — neither file exists in this repo, so no workflow changes were made.

References

• Jira: COMPASS-4447
• Dependabot alert [SILK-2313] updates test config #44 (js-yaml): https://github.com/zendesk/persistence/security/dependabot/44
• Dependabot alert Bump the npm_and_yarn group across 1 directory with 2 updates #45 (brace-expansion): https://github.com/zendesk/persistence/security/dependabot/45

Changes

• package-lock.json: brace-expansion 1.1.13 → 1.1.18 and 2.0.3 → 2.1.4 (both ≥ 1.1.16); js-yaml 4.1.1 → 4.3.1 everywhere (≥ 4.3.0)
• package.json: added js-yaml: ^4.3.1, brace-expansion: ^1.1.18, and a nested mocha > minimatch > brace-expansion: ^2.1.4 override, alongside the existing diff/serialize-javascript overrides
• Workflow files: unchanged — .github/workflows/claude.yml and .github/workflows/claude-auto-review.yml do not exist in this repo; the only workflow present (.github/workflows/actions.yml) does not contain the target string

Risks

• Low — patch-level bumps to transitive lint/test tooling dependencies (mocha, standard/eslint toolchain deps) only. No production dependencies changed (only ioredis is listed there and is untouched).
• Rollback: revert this PR / git revert, or re-run npm install against the previous lockfile.

Test plan

• npm audit — 0 vulnerabilities after fix (was 2 high severity)
• npm ls brace-expansion — confirms 1.1.18 and 2.1.4 tree-wide (both ≥ 1.1.16)
• npm ls js-yaml — confirms 4.3.1 tree-wide (≥ 4.3.0)
• Re-verified after adding package.json overrides — versions unchanged, npm audit still 0 vulnerabilities
• npm run lint (standard) — passes, no output
• npm test — re-ran after the overrides change, all suites still passing with local Redis running
• No build script exists in package.json — N/A
• Confirmed target workflow files do not exist in this repo — no changes made, no changes needed

🤖 Generated with Claude Code