build(deps): bump ip-address and brace-expansion to patch high severity advisories

[gkartalis]

This PR resolves []

Description

Clears 5 open high severity Dependabot alerts on the root yarn.lock. All of them are transitive dependencies whose declared semver ranges already admit the patched version, so a plain yarn up -R re-resolves them — no resolutions pin or direct dependency bump needed.

yarn up -R ip-address brace-expansion

Alert	Package	Vulnerable range	Was	Now	Pulled in by	Advisory
#462	ip-address	<= 10.3.0	10.2.0	10.4.0	socks (via socks-proxy-agent)	GHSA-mwp4-54f8-5fhr — leading-zero octets decoded as decimal instead of octal, enabling SSRF / trust-boundary bypass
#455	brace-expansion	< 1.1.17	1.1.16	1.1.18	minimatch@3.1.5	ReDoS
#456	brace-expansion	< 1.1.18	1.1.16	1.1.18	minimatch@3.1.5	ReDoS
#457	brace-expansion	>= 2.0.0, < 2.1.4	2.1.3	2.1.4	minimatch@9.0.9	ReDoS
#458	brace-expansion	>= 4.0.0, < 5.0.9	5.0.8	5.0.9	minimatch@10.2.5	ReDoS

The diff is yarn.lock only — 12 lines changed, no package.json edits, no new pins to clean up later.

Remaining high severity alerts (not in this PR)

• node-forge (@orta -> always use desktop web urls when sharing #222, @ashfurrow => support analytics URLs in the ARPersonalizeWebViewController #317, Browse section shows artists twice #318, Poll auction work price, reserve, etc., during bidding #319) in bin/yarn.lock — needs a resolutions pin because eas-cli exact-pins node-forge@1.3.1. Handled in a follow-up PR.
• parse-git-config (Remove Explore artwork categories on fair overview #190) — no patched version exists; the only fix is bumping danger 11 → 13, which drops the dependency entirely. Needs its own PR.
• concurrent-ruby (@orta -> snapshots can automatically be named after the spec #403) — RubyGems, out of scope here.

PR Checklist

• I have tested my changes on the following platforms:
  • Android.
  • iOS.
• I hid my changes behind a feature flag, or they don't need one.
• I have included screenshots or videos at least on Android, or I have not changed the UI.
• I have added tests, or my changes don't require any.
• I added an app state migration, or my changes do not require one.
• I have documented any follow-up work that this PR will require, or it does not require any.
• I have added a changelog entry below, or my changes do not require one.

To the reviewers 👀

• I would like at least one of the reviewers to run this PR on the simulator or device.

Changelog updates

Changelog updates

Dev changes

• Bump ip-address and brace-expansion transitive deps to clear 5 high severity Dependabot alerts

Need help with something? Have a look at our docs, or get in touch with us.

🤖 Generated with Claude Code

[artsyit]

This PR contains the following changes:

• Dev changes (Bump ip-address and brace-expansion transitive deps to clear 5 high severity Dependabot alerts - gkartalis)

Generated by 🚫 dangerJS against f5e1545