chore(deps): resolve fast-uri and brace-expansion advisories

[mcottontensor]

Clears the two open Dependabot alerts on master.

Alert	Package	Severity	Was	Now
#228	fast-uri	high	3.1.4	3.1.5
#227	brace-expansion	high	5.0.8	5.0.9

• fast-uri — host confusion via backslash authority introducer (vulnerable >= 3.0.0, < 3.1.5).
• brace-expansion — DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (vulnerable >= 4.0.0, < 5.0.9).

Changes

Both packages are already pinned through the root overrides block, so the fix is to raise the override floors:

-"brace-expansion@^5": "^5.0.8",
-"fast-uri@^3": "^3.1.4",
+"brace-expansion@^5": "^5.0.9",
+"fast-uri@^3": "^3.1.5",

npm install alone does not re-resolve transitives that the lockfile already has locked, so npm update fast-uri brace-expansion was needed to regenerate the lockfile. All five brace-expansion@^5 tree positions (glob, nodemon, test-exclude, typedoc, @typescript-eslint/typescript-estree) now resolve to 5.0.9, and fast-uri to 3.1.5. The unrelated root brace-expansion@1.x moved 1.1.17 → 1.1.18 as a side effect of re-resolution; 1.x is outside the advisory range either way.

Both are dev-only transitive dependencies — nothing ships to a published package or runtime path, so no changeset.

Testing

• npm run build — all workspaces build clean
• Frontend/library unit tests — 46 passed, 5 suites
• npm audit — both advisories gone

npm audit still reports ajv (ReDoS via $data) and file-type (infinite loop on malformed MKV/ASF). Neither has an open Dependabot alert and both need breaking upgrades of eslint-plugin-tsdoc / open-cli, so they are left out of this PR.

[mcottontensor]

💔 Some backports could not be created

Status	Branch	Result
❌	UE5.6	Backport failed because of merge conflicts You might need to backport the following PRs to UE5.6: - fix(deps): resolve dependabot security alerts (#905)
❌	UE5.7	Backport failed because of merge conflicts
✅	UE5.8

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

backport --pr 952

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details