Bump the npm_and_yarn group across 1 directory with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: brace-expansion and js-yaml.

Updates brace-expansion from 1.1.15 to 1.1.21

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

Updates js-yaml from 3.15.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

• 5c45bd6 3.15.2 released
• 5a708f9 dist rebuild
• 3485bc0 Backport merge limits from v5.4.1
• f34812f Update .gitignore
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2f6b4103-4e03-4eab-acc7-276a62633237

---

📥 Commits

Reviewing files that changed from the base of the PR and between d25a013 and ca57499.

---

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

---

📒 Files selected for processing (1)

• packages/web/package.json

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The web package updates seroval from 1.6.3 to 1.6.4 and vite from ^8.2.0 to ^8.2.1.

Changes

Web dependency updates

Layer / File(s)	Summary
Update web dependency versions packages/web/package.json	The manifest updates the declared versions of seroval and vite. Other listed dependency versions are unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: dodok8

---

Merge Risk | ⚪ Minimal · up to ca574

Merge Risk: ⚪ Minimal · up to ca574

The dependency updates match the lockfile. Although Vite remains within the advisory’s affected range, the inspected web configuration does not show the vulnerable usage pattern, and this change does not establish a new exposure. No concrete merge-blocking risk is demonstrated.

Security Architecture Review

Security architecture risk: 🔵 Low · up to ca574

The dependency declarations and resolved versions agree, and no new application boundary or attack path has been demonstrated. A possible development-server script-execution path remains unverified because the framework implementation needed to establish it is unavailable.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The unresolved candidate concerns the web development-server and browser-origin boundary. The development binding can forward GraphQL requests to a configured backend, but no exploit chain to backend authority, tenant data, or production exposure has been established.

Security Findings and Attack Paths

• observed — No Security finding is retained. The script-execution candidate remains deferred because it is unknown whether Solid Start generates the required inline module and passes an unchanged browser URL to transformIndexHtml. Neither a complete attack path nor a PR-introduced worsening is established.

Trust Boundaries and Controls

• observed — The development bridge applies only during serving. It invokes prepareWebRequest before continuing, returns early for a response, and returns HTTP 400 on an exception. These branches are visible controls, but their effectiveness against the dependency-internal transform condition is not established.

---

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly identifies a grouped dependency update affecting one directory and two dependencies. It aligns with the stated pull request objectives and is concise.
Description check		The description explains the two dependency updates and includes their versions and security-related changes. It is directly related to the pull request objectives.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}