weekly-fixes/2026-06-21: patch brace-expansion & js-yaml DoS advisories

[gndclouds]

Weekly maintenance — 2026-06-21

Automated weekly review of the most recent PR(s) + dependency/security audit. This run found one concrete, safely-fixable item (two moderate DoS advisories in dev-tooling transitives) and fixes it here. Everything else ran clean or is an existing human-review item.

What changed (security/packages)

Lockfile-only bumps via npm audit fix --package-lock-only — no package.json semver ranges changed, all drop-in non-breaking updates:

Package	From → To	Severity	Advisory
brace-expansion	5.0.5 → 5.0.6, 1.1.12 → 1.1.15	Moderate	GHSA-f886-m6hf-6m8v (zero-step sequence hang/OOM), GHSA-jxxr-4gwj-5jf2 (large numeric range defeats max DoS guard)
js-yaml	4.1.1 → 4.2.0	Moderate	GHSA-h67p-54hq-rp68 (quadratic merge-key alias DoS)

Both are dev-tooling transitives (eslint/glob, config loaders). DoS-only, not on a production request path, but cheap and safe to patch.

Verification

• npm ci — installs clean against the updated lockfile
• npx tsc --noEmit — clean
• npx eslint . — clean
• No test suite exists in the repo (nothing to run)

The four checks, in full

1. PR correctness — Reviewed the most recent merged PR #12 (weekly dependency advisories + ai-site-theme.ts default-model bump to claude-sonnet-4-6). The model bump is correct — claude-sonnet-4-6 is a current, valid model id and the ANTHROPIC_MODEL override path is unchanged. No correctness regressions found.
2. Related tickets — No Linear/Notion ticket links are attached to the reviewed PRs, so acceptance criteria could not be cross-checked.
3. Packages — package.json ranges are healthy; this PR only patches the two transitive advisories above in package-lock.json. Dual-lockfile situation persists (see "Needs human review").
4. Security — npm audit now reports 2 moderate remaining, both the nested postcss (<8.5.10, </style> stringify XSS) bundled inside next. Fixing it requires npm audit fix --force (Next.js major downgrade), which is unsafe — left for a deliberate upgrade. No committed secrets, injection, or unsafe deserialization introduced by recent changes.

Needs human review (not fixed here)

• Nested postcss XSS inside next. Only fixable by changing the next major version — out of scope for a minimal lockfile patch.
• Dual lockfile. Both package-lock.json and yarn.lock are committed. Running npm audit fix rewrites yarn.lock destructively (drops platform-specific @img/sharp-* and @emnapi/* binaries), so I deliberately left yarn.lock untouched and updated package-lock.json only — same convention as weekly-fixes/2026-06-19: patch critical/high dependency advisories (handlebars, next, postcss, defu, effect) #12. Recommend standardizing on npm and removing yarn.lock; it's a maintainer decision tied to the Vercel build config.
• @anthropic-ai/sdk sits at ^0.105.0 (current). No action needed this run.

Context

Follows the previous weekly run #12, which patched the critical/high advisories (handlebars, next, defu, effect). Branched off main; original branches untouched; one PR this run.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tiny-garden	Ready	Preview, Comment	Jun 21, 2026 7:08am