fix(deps): pin brace-expansion, js-yaml, and aiohttp>=3.14.3

[FJ-Riveros]

Summary

• Raise pnpm + uv security pins for open HIGH Dependabot advisories

Test plan

• CI green
• Confirm lockfiles resolve patched versions

[Copilot]

Pull request overview

Raises security pins in both the Python (uv) and Node (pnpm) dependency graphs to remediate high-severity advisories by upgrading/pinning aiohttp, brace-expansion, and js-yaml.

Changes:

• Update uv overrides/lock to require and resolve aiohttp>=3.14.3.
• Update pnpm overrides/lock to pin patched brace-expansion and js-yaml versions across multiple major ranges.
• Adjust pnpm supply-chain hardening configuration (minimumReleaseAgeExclude) to allow resolving newer patched packages.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 1 comment.

File	Description
uv.lock	Updates exclude-newer and locks aiohttp to 3.14.3 with refreshed artifacts/hashes.
pyproject.toml	Updates uv override-dependencies to require aiohttp>=3.14.3 (and keeps other security floors).
pnpm-workspace.yaml	Adds minimumReleaseAgeExclude entries and updates pnpm overrides for patched brace-expansion / js-yaml.
pnpm-lock.yaml	Regenerates lockfile overrides and resolutions to reflect new brace-expansion / js-yaml pins.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

pnpm-workspace.yaml:56

• The brace-expansion overrides cover <1.1.18, >=2.0.0 <2.1.4, and >=4.0.0 <5.0.9, but the nearby CVE note indicates the affected range starts at >=3.0.0. Consider expanding the override to include 3.x as well so a future transitive brace-expansion@3.* can’t bypass the security pin.

  "brace-expansion@<1.1.18": "1.1.18"
  "brace-expansion@>=2.0.0 <2.1.4": "2.1.4"
  "brace-expansion@>=4.0.0 <5.0.9": "5.0.9"

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 4 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

pnpm-workspace.yaml:45

• This CVE note says no patched 3.x/4.x exists, but the overrides below pin a patched 3.x version (3.0.6) and also handle 4.x by forcing 5.0.9. Update the comment so it matches the actual override strategy.

  # CVE-2026-13149: no patched 3.x/4.x exists — advisory remediates >=3.0.0 via 5.x

[Copilot]

Pull request overview

Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

pnpm-workspace.yaml:17

• minimumReleaseAgeExclude entries look like a single string with multiple versions joined by || (and the later versions omit the package name). pnpm expects one package selector per list item, so this likely won’t match what you intend and may be ignored or fail parsing. Split into separate fully-qualified entries per version.

  - js-yaml@3.15.1 || 4.3.1 || 5.2.2
  - brace-expansion@1.1.18 || 2.1.4 || 3.0.6 || 5.0.9

pnpm-workspace.yaml:46

• The brace-expansion CVE comment claims “no patched 3.x/4.x exists”, but this file now pins a patched 3.x (3.0.6). Also, the comment is separated from the related override entries by an unrelated block, which makes it easy to miss/forget to update. Replace it with an accurate comment adjacent to the brace-expansion overrides.

  # CVE-2026-13149: no patched 3.x/4.x exists — advisory remediates >=3.0.0 via 5.x

[Copilot]

Pull request overview

Copilot reviewed 3 out of 5 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

pnpm-workspace.yaml:47

• The CVE note says there's "no patched 3.x/4.x" and remediation for ">=3.0.0" is via 5.x, but the overrides below pin some 3.x ranges to 3.0.6 (and 2.x/1.x to same-major versions). Please reconcile the comment and the actual override strategy so it's clear which versions are considered patched for this CVE.

  # CVE-2026-13149: no patched 3.x/4.x exists — advisory remediates >=3.0.0 via 5.x