Fix npm Audit: bump fast-uri, brace-expansion, js-yaml overrides

[jeremy]

npm Audit (TypeScript SDK) is red on every PR since three high-severity advisories published after the last green security run (2026-07-20):

• fast-uri GHSA-4c8g-83qw-93j6 — host confusion via failed IDN canonicalization (patched 3.1.3 / 4.0.1)
• brace-expansion GHSA-3jxr-9vmj-r5cp — DoS via exponential-time expansion (patched 5.0.7)
• js-yaml GHSA-52cp-r559-cp3m — quadratic CPU via merge-key chains (patched 4.3.0; pinned ^4.3.0 to stay on the 4.x line since js-yaml 5 is a major bump for openapi-typescript's transitive use)

All three ride the existing overrides pattern in typescript/package.json. npm audit clean; make ts-check (build + vitest) green; ts-generate/ts-generate-services verified working under the new resolutions on the sibling branch.

Note: the bc5-readiness stack root #293 carries this exact same change branch-side (it owns the override pattern via its earlier fast-uri pin). Identical content — whichever lands second merges cleanly. This standalone PR exists so main-based PRs (e.g. the TS Content-Type fix, dependabot PRs) can go green without waiting on the stack.

---

Summary by cubic

Fixes failing npm audit checks in the TypeScript SDK by overriding vulnerable transitive deps. Updates fast-uri, brace-expansion, and js-yaml to patched versions so PRs go green again.

• Dependencies
  • Override fast-uri to >=3.1.3 to patch host confusion; resolves to 4.1.1.
  • Override brace-expansion to >=5.0.7 to fix DoS via exponential expansion.
  • Override js-yaml to ^4.3.0 to fix quadratic CPU issue; stay on 4.x (5.x is a major bump for transitive use).
  • npm audit clean; TypeScript build and tests pass.

^{Written for commit b1e2d22. Summary will update on new commits.}

[Copilot]

Pull request overview

This PR addresses newly published high-severity npm advisories affecting the TypeScript SDK by updating overrides to force patched transitive dependency versions, restoring clean npm audit results and keeping the TS build/test pipeline green.

Changes:

• Add npm overrides for brace-expansion, fast-uri, and js-yaml to pull patched versions.
• Refresh package-lock.json to reflect the new resolved dependency graph (including updated resolved versions and metadata).

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
typescript/package.json	Adds overrides to force patched transitive dependency versions to satisfy npm audit.
typescript/package-lock.json	Updates the lockfile to reflect the new override resolutions.

Files not reviewed (1)

• typescript/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}