[teallarson]

Closes the nine open Dependabot alerts. All are transitive dev dependencies in the build/test toolchain — nothing ships in the published package.

Dependabot alerts fixed

Package	Was	Now	Alerts
js-yaml	3.14.2, 4.1.1	3.15.2, 4.3.2	#47 #46 #43 #42 #41 #40 — quadratic CPU in !!omap resolution and in merge-key chains
brace-expansion	2.1.0	2.1.4	#48 — exponential-time expansion of consecutive non-expanding {} groups
@humanfs/node	0.16.7	0.16.8	#50 — recursive copy follows symlinks outside the source tree
@babel/core	7.28.6	7.29.7	#39 — arbitrary file read via sourceMappingURL comment

Also fixed (reported by pnpm audit, not by Dependabot)

• minimatch was still resolving to the vulnerable 9.0.5. The blanket "minimatch": "^9.0.5" override outranks the narrower minimatch@>=9.0.0 <9.0.7 selectors below it, so those selectors never took effect. Bumped the blanket to ^9.0.9, which resolves it and makes the two range selectors redundant.
• browserslist 4.28.1 → 4.28.8 (ReDoS in normalizeStats).

The other override entries were duplicates covering ranges a sibling entry already covered (three handlebars entries, two flatted, two minimatch). Collapsed to one entry per package.

Known remaining finding

pnpm audit still reports one moderate: fflate <0.8.3 under @arethetypeswrong/cli. Overriding it to 0.8.3 makes attw --pack fail with Cannot read properties of undefined (reading 'filename'), so it's left alone — it needs an @arethetypeswrong/cli upgrade instead. Dependabot does not flag it.

Verification

Clean node_modules install, then:

• pnpm audit → 1 moderate remaining (the fflate one above), down from 6
• pnpm lint → eslint, build, tsc, attw, publint all pass
• pnpm test → 22 suites, 395 tests passing

🤖 Generated with Claude Code