fix: bump brace-expansion/js-yaml overrides to clear high-severity audit

[HarshMN2345]

Summary

• bun audit --audit-level high was failing CI on two transitive high-severity advisories pulled in via eslint/typescript-eslint/@sentry/vite-plugin: brace-expansion (ReDoS) and js-yaml (quadratic CPU via merge-key chains).
• The existing brace-expansion override (>=5.0.5) didn't reach the patched range; bumped to >=5.0.7 and added a js-yaml override (^4.3.0).
• No direct dependency version changes — this only tightens transitive-dependency overrides.

Test plan

• bun audit --audit-level high reports 0 vulnerabilities
• bun run check passes with no new errors

[appwrite]

Console (appwrite/console)

Project ID: 688b7bf400350cbd60e9

Sites (1)

Site	Status	Logs	Preview	QR
console-stage 688b7cf6003b1842c9dc	Processing	View Logs	Preview URL

Tip

Git integration provides automatic deployments with optional PR comments

[greptile-apps]

Greptile Summary

This PR updates Bun dependency metadata to clear high-audit findings. The main changes are:

• Bumps the brace-expansion override from >=5.0.5 to >=5.0.7.
• Adds a js-yaml override at ^4.3.0.
• Refreshes bun.lock for the resolved transitive versions.

Confidence Score: 4/5

The dependency bump is close, but the lockfile integrity change should be fixed before merging.

• The patched brace-expansion and js-yaml versions are reflected in the lockfile.
• Three external URL dependencies lost their content hashes during the refresh.
• The brace-expansion override can admit a future major version on a later lockfile update.

bun.lock and package.json

Security Review

The dependency bumps address audit findings, but the lockfile also drops integrity hashes for external URL tarballs. That weakens content verification for those packages during frozen installs.

Important Files Changed

Filename	Overview
package.json	Updates dependency overrides for brace-expansion and js-yaml; the brace-expansion range remains broader than needed.
bun.lock	Locks the patched transitive versions, but also removes integrity hashes from three existing external URL dependencies.

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
bun.lock:129
**URL Tarballs Lose Integrity**

This lockfile refresh removes the `sha512` content pin from the external `pkg.vc` tarball for `@appwrite.io/console` while keeping the same URL. Frozen installs can no longer verify that this URL serves the same bytes that were previously locked and audited; the two Pink URL packages below lose the same protection.

### Issue 2 of 2
package.json:107
**Open-Ended Security Override**

The `brace-expansion` override is a lower-bound range, so a future lockfile refresh can satisfy it with a new major version even when the transitive consumer only requested the 5.x line. Since this override is meant to pin the patched dependency for CI, a tighter range such as the patched 5.x line would avoid pulling an unrelated major upgrade into an audit-only change.

_{Reviews (1): Last reviewed commit: "fix: bump brace-expansion/js-yaml overri..." | Re-trigger Greptile}

[greptile-apps]

URL Tarballs Lose Integrity

This lockfile refresh removes the sha512 content pin from the external pkg.vc tarball for @appwrite.io/console while keeping the same URL. Frozen installs can no longer verify that this URL serves the same bytes that were previously locked and audited; the two Pink URL packages below lose the same protection.

Prompt To Fix With AI

This is a comment left during a code review.
Path: bun.lock
Line: 129

Comment:
**URL Tarballs Lose Integrity**

This lockfile refresh removes the `sha512` content pin from the external `pkg.vc` tarball for `@appwrite.io/console` while keeping the same URL. Frozen installs can no longer verify that this URL serves the same bytes that were previously locked and audited; the two Pink URL packages below lose the same protection.

How can I resolve this? If you propose a fix, please make it concise.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Open-Ended Security Override

The brace-expansion override is a lower-bound range, so a future lockfile refresh can satisfy it with a new major version even when the transitive consumer only requested the 5.x line. Since this override is meant to pin the patched dependency for CI, a tighter range such as the patched 5.x line would avoid pulling an unrelated major upgrade into an audit-only change.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 107

Comment:
**Open-Ended Security Override**

The `brace-expansion` override is a lower-bound range, so a future lockfile refresh can satisfy it with a new major version even when the transitive consumer only requested the 5.x line. Since this override is meant to pin the patched dependency for CI, a tighter range such as the patched 5.x line would avoid pulling an unrelated major upgrade into an audit-only change.

How can I resolve this? If you propose a fix, please make it concise.

[HarshMN2345]

Superseded by #3134 — consolidating everything into a single PR.