fix(deps): execute npm audit fix

[MikeMcC399]

Situation

npm audit reports multiple high severity vulnerabilities

$ npm audit
# npm audit report

brace-expansion  <=1.1.17 || 3.0.0 - 5.0.8
Severity: high
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
fix available via `npm audit fix`
node_modules/@eslint/config-array/node_modules/brace-expansion
node_modules/brace-expansion

js-yaml  4.0.0 - 4.3.0
Severity: high
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
fix available via `npm audit fix`
node_modules/js-yaml

undici  <=6.27.0 || 7.0.0 - 7.28.0
Severity: high
undici vulnerable to downstream response desynchronization via retry interceptor - https://github.com/advisories/GHSA-8xcm-r25x-g524
undici vulnerable to downstream response desynchronization via retry interceptor - https://github.com/advisories/GHSA-8xcm-r25x-g524
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives - https://github.com/advisories/GHSA-4cwx-7wf7-3272
undici vulnerable to CRLF Injection via blob-like body 'type' property - https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
undici vulnerable to CRLF Injection via blob-like body 'type' property - https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives - https://github.com/advisories/GHSA-jr45-8vmc-qm54
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields - https://github.com/advisories/GHSA-v3r7-h72x-cjcm
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields - https://github.com/advisories/GHSA-v3r7-h72x-cjcm
fix available via `npm audit fix`
node_modules/cheerio/node_modules/undici
node_modules/undici

3 high severity vulnerabilities

To address all issues, run:
  npm audit fix

Change

Execute npm audit fix and rebuild action.

---

Note

Low Risk
Dependency version bumps and security hardening in bundled libraries; no application logic changes in this repo’s own source, with low expected behavior change for normal HTTP/glob usage.

Overview
Addresses high-severity npm audit findings by refreshing package-lock.json and rebuilding the action bundle so runtime code picks up patched transitive dependencies.

brace-expansion (1.1.18 / 5.0.9): expansion is refactored to cap total character growth (EXPANSION_MAX_LENGTH), bound combine steps, and use iterative expansion instead of deep recursion—mitigating DoS/OOM and stack issues (including CVE-2026-14257-style bypasses).

undici (6.28.0, plus cheerio’s 7.29.0 in the lockfile): bundled client behavior tightens header and content-type coercion (reject invalid values after stringification), cookie domain/path/unparsed attribute validation when serializing cookies, and retry handler checks that partial/range responses match Content-Length to reduce desync and injection risks.

js-yaml (4.3.1): lockfile-only bump for quadratic CPU issues in YAML parsing (typically dev/tooling, not the main action runtime unless bundled elsewhere).

^{Reviewed by Cursor Bugbot for commit 72998a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cypress-app-bot]

• Create a Draft Pull Request if your PR is not ready for review. Mark the PR as Ready for Review when you're ready for a Cypress team member to review the PR.

[github-actions]

🎉 This PR is included in version 7.4.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀