MAINT: Bump brace-expansion, js-yaml, postcss, and setuptools for Dependabot alerts

[romanlutz]

Description

Resolves six open Dependabot alerts by bumping locked dependency versions. All six are transitive; only lockfiles and the existing overrides block in frontend/package.json change, so there are no source or API changes.

Package	Change	Advisory
brace-expansion	5.0.6 -> 5.0.8, 2.1.1 -> 2.1.2, 1.1.15 -> 1.1.16	GHSA-3jxr-9vmj-r5cp (DoS via exponential-time expansion)
js-yaml	4.2.0 -> 4.3.0	quadratic CPU via YAML merge-key chains
postcss	8.5.13 -> 8.5.23 (nanoid moves with it)	path traversal via sourceMappingURL
setuptools	80.9.0 -> 83.0.0	sdist MANIFEST.in exclusion bypass on macOS APFS/HFS+

brace-expansion

The tree had three separate copies, each pinned by a different minimatch major (v1 under test-exclude, v2 under glob, v5 top level). The usual fear here is that collapsing them onto one version breaks things, since the v1/v2/v5 APIs differ. That is not needed: each patched release lives inside its own major line, so a plain npm update brace-expansion bumped all three with no new overrides entry and no major upgrades.

js-yaml and postcss

Both were already pinned in the overrides block for earlier advisories, so this only widens the existing pins.

setuptools

Transitive via jupyterlab, spacy, thinc, and torch. Only the locked version moves; the setuptools>=64.0.0 build-system pin in pyproject.toml is untouched.

One thing to flag for reviewers: the setuptools entry in uv.lock loses its upload-time field. The package index used to resolve this bump does not publish that field, so uv lock omits it. The URLs, sha256 hashes, and byte sizes are all correct and point at files.pythonhosted.org as before; upload-time will come back on the next relock. The uv.lock diff is deliberately scoped to just the 3 lines of the setuptools block.

Not included

Dependabot also flags react-router (alert #216, GHSA-qwww-vcr4-c8h2, RSC mode CSRF bypass). That one is intentionally left out of this PR because it is a genuine breaking upgrade rather than a version bump: v8 removes the react-router-dom package entirely, is ESM-only, and declares engines: node >=22.22.0 while frontend_tests.yml pins NODE_VERSION: "20". The advisory itself notes it "only affects your application if you are using the unstable RSC APIs", and this frontend is a plain client-side SPA with no RSC, so the vulnerability is not reachable. It has been done separately and will come as its own PR.

Tests and Documentation

No documentation changes; this is a dependency-only PR, so JupyText was not run.

Validation performed locally:

• Frontend: npm ci (lockfile integrity verified), npm test (984/984 passing across 50 suites), npm run build, npm run lint all clean.
• Python: uv lock --check passes with no drift, and uv run pytest tests/unit -k "converter or memory" gives 2191 passed, 49 skipped.

Note on a pre-existing flake: InitializerParametersDialog > submits toggled boolean and selected multiselect values, and occasionally other tests such as CreateTargetDialog > should hide the Authentication field until a target type is selected, fail intermittently. This reproduces on unmodified main, so it is not a regression from these bumps. It shows up most often under npm run test:coverage but has also been observed on a plain npm test run. The affected tests pass reliably when run in isolation. Worth fixing separately.