fix(deps): pin brace-expansion, js-yaml, and aiohttp>=3.14.3

pnpm-workspace.yaml

@@ -9,6 +9,8 @@ minimumReleaseAge: 14400
 # TODO(2026-08-10): drop this once ip-address@10.4.0 clears minimumReleaseAge
 # (published 2026-07-31; 10-day gate ⇒ ~2026-08-10).
 minimumReleaseAgeExclude:
+  - js-yaml
+  - brace-expansion
   - ip-address@10.4.0
 # Fail (don't silently downgrade) if a package's publisher trust level drops
 trustPolicy: no-downgrade
@@ -36,10 +38,9 @@ overrides:
   "axios": ">=1.18.0"
   "axios@1.14.1": ">=1.18.0"
   "axios@0.30.4": "0.30.3"
-  "brace-expansion@<1.1.16": "1.1.16"
-  "brace-expansion@>=2.0.0 <2.1.2": "2.1.2"
+
   # CVE-2026-13149: no patched 3.x/4.x exists — advisory remediates >=3.0.0 via 5.x
-  "brace-expansion@>=3.0.0 <5.0.8": "5.0.8"
+
   "ip-address@<=10.1.0": "10.1.1"
   "uuid@11.1.0": "11.1.1"
   "ws@>=7.0.0 <7.5.11": "7.5.11"
@@ -50,6 +51,12 @@ overrides:
   "base-x": "^5.0.1"
   "@tootallnate/once": ">=3.0.1"
 
+  "brace-expansion@<1.1.18": "1.1.18"
+  "brace-expansion@>=2.0.0 <2.1.4": "2.1.4"
+  "brace-expansion@>=4.0.0 <5.0.9": "5.0.9"
+  "js-yaml@>=3.0.0 <3.15.1": "3.15.1"
+  "js-yaml@>=4.0.0 <4.3.1": "4.3.1"
+  "js-yaml@>=5.0.0 <=5.2.1": "5.2.2"
 # Dependencies permitted to run install/build scripts.
 allowBuilds:
   bigint-buffer-fixed: true # native, replaces bigint-buffer via override

pyproject.toml

@@ -22,10 +22,10 @@ dev = [
 [tool.uv]
 exclude-newer = "10 days"
 override-dependencies = [
-    "aiohttp>=3.14.1",  # CVE-2026-34993, CVE-2026-47265, CVE-2026-54273/54274/54276/54277/54278
     "Pygments>=2.20.0",
     "urllib3>=2.7.0",
-    "idna>=3.15",  # CVE-2026-45409
+    "idna>=3.15",
+    "aiohttp>=3.14.3",
 ]
 
 [tool.ruff]