[SpyZzey]

Updates two transitive dependencies in package-lock.json to resolve all 12 open Dependabot security alerts in this repository. package.json is unchanged. Grouped into a single PR so the repository's alerts can be cleared in one review instead of several separate dependency updates.

Alerts addressed

• GHSA-j8rh-479h-cp32 (CVE-2026-101904) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-4hqw-qxg8-jxx2 (CVE-2026-101900) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-m8m8-qj5v-23w3 (CVE-2026-101905) — axios, high — 1.18.1 -> 1.20.0
• GHSA-44g4-m2mj-wpvx (CVE-2026-101899) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-r4gj-5m52-g5wh (CVE-2026-101907) — axios, high — 1.18.1 -> 1.20.0
• GHSA-vh66-26gq-q6x8 (CVE-2026-101908) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-9fr6-4gfg-395g (CVE-2026-101902) — axios, medium — 1.18.1 -> 1.20.0
• GHSA-x97p-jq2g-jp4f (CVE-2026-101909) — axios, high — 1.18.1 -> 1.20.0
• GHSA-3pq3-5fj3-cg6v (CVE-2026-101898) — axios, high — 1.18.1 -> 1.20.0
• GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) — brace-expansion, medium — 1.1.18 -> 1.1.21
• GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) — brace-expansion, medium — 2.1.4 -> 2.1.7
• GHSA-q2hr-2g5m-vwhr (CVE-2026-102277) — brace-expansion, medium — 5.0.9 -> 5.0.12

How it was fixed

Both packages are transitive-only, so each vulnerable lockfile entry was moved to its patched release and nothing was promoted to a direct dependency:

• axios 1.18.1 -> 1.20.0 (covers nine advisories)
• brace-expansion 1.1.18 -> 1.1.21 (four nested entries), 2.1.4 -> 2.1.7, 5.0.9 -> 5.0.12

The three brace-expansion major lines are tracked separately because each has its own alert and an update on one line does not address the others. Entries already on a patched version were left untouched.

Both packages are development dependencies, so no published artifact changes. The diff is 32 changed lines and contains only these version changes: no unrelated upgrades, no added or removed packages, and no package.json change. npm audit reports neither advisory after the change.

Verification

Run locally on this exact commit:

• npm install — succeeds
• npm run build — succeeds
• npm test (lint + unit tests) — 14 test files, 133 tests passing, 1 skipped; lint clean (13 pre-existing warnings, 0 errors)

Superseded pull request

• chore: Bump brace-expansion #180 — brace-expansion 1.1.18 -> 1.1.21 and 2.1.4 -> 2.1.7

This PR covers the same updates plus the 5.x line, so #180 has been closed. If this PR fails CI or is abandoned, it can be restored by commenting the Dependabot reopen command on it; Dependabot will not recreate it on its own.

#178 (undici 7.29.0 -> 7.30.0) is left open: it is not tied to any of this repository's open security alerts, so it is not superseded by this PR.

Merging this PR is expected to resolve all 12 of this repository's open alerts, leaving none open.

All upgraded packages are available internally.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.16%. Comparing base (b1c87de) to head (20ba6bb).

❌ Your project check has failed because the head coverage (88.16%) is below the target coverage (90.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #182   +/-   ##
=======================================
  Coverage   88.16%   88.16%           
=======================================
  Files          25       25           
  Lines         355      355           
  Branches      100      100           
=======================================
  Hits          313      313           
  Misses         42       42           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.