fix: remediate Dependabot security alerts (2026-07-30)

[typeagent-bot]

Automated Dependabot Alert Remediation

This PR was automatically generated by the fix-dependabot-alerts workflow.
Each fix was applied individually and build-verified before inclusion.

Summary

• Applied (16): @hono/node-server app-builder-lib brace-expansion builder-util-runtime diff esbuild js-yaml linkify-it nodemailer qs sharp underscore undici uuid ws xml2js
• **Blocked (1):**js-yaml
• No patch available (0): (none)
• Deferred — fix not yet 7 days old (0): (none)
• Rolled back (3): (none)
• Skipped (recent rollback, 0): (none)
• Workspaces with analysis failures: (none)
• Build: ✅ Passed
• Shell packaging: ✅ Passed

Note: the analysis source (fix-dependabot-alerts.mjs) is broader than the GitHub Dependabot REST API — it also audits the lockfile directly. Some packages listed above may not have a corresponding open Dependabot alert, and vice versa.

Why blocked packages couldn't be auto-fixed

Dependency chains (`--show-chains` output)

===== docs =====

══════════════════════════════════════════════════════════════════════
  Fetching open Dependabot alerts from GitHub
══════════════════════════════════════════════════════════════════════
  Repository: microsoft/TypeAgent
  Found 7 alert(s) across 4 package(s)

══════════════════════════════════════════════════════════════════════
  Analyzing vulnerabilities
══════════════════════════════════════════════════════════════════════

  [1/4] 📦 brace-expansion (high) — ✗ 5.0.5 → need ≥5.0.7
     Fix: pnpm update brace-expansion -r
     → minimatch@10.2.4
       → maximatch@0.1.0
         → @11ty/recursive-copy@4.0.3
           … 1 more level(s) collapsed (use --show-chains=full)
  ⚠  Could not resolve shell production deps — shell packaging post-check will still validate

  [2/4] 📦 js-yaml (high) — ✗ 3.14.2, ✗ 4.1.1 → need ≥4.3.0
     ↳ used by: typeagent-docs
     Actions: (requires --auto-fix)
       [override] gray-matter@4.0.3 pins js-yaml ^3.13.1, already at latest — no update available
     Risk: ▲ high — major version bump 3.14.2 → 4.3.0, 1 parent(s) may break
     → @11ty/eleventy@3.1.2
       → typeagent-docs
     → gray-matter@4.0.3
       → @11ty/eleventy@3.1.2 (see above)

  [3/4] 📦 linkify-it (high) — ✗ 5.0.1 → need ≥5.0.2
     Fix: pnpm update linkify-it -r
     → markdown-it@14.2.0
       → markdown-it-replace-link@1.2.2
         → typeagent-docs
       → @11ty/eleventy@3.1.2
         → typeagent-docs
       → markdown-it-anchor@8.6.7
         → typeagent-docs
       → typeagent-docs

  [4/4] 📦 ws (high) — ✗ 8.18.2 → need ≥8.21.0
     Fix: pnpm update ws -r
     → @11ty/eleventy-dev-server@2.0.8
       → @11ty/eleventy@3.1.2
         → typeagent-docs

══════════════════════════════════════════════════════════════════════
  Resolution plan (dry run)
══════════════════════════════════════════════════════════════════════
  ✓  [dry-run] pnpm update brace-expansion -r → >=5.0.7
  ✓  [dry-run] pnpm update linkify-it -r → >=5.0.2
  ✓  [dry-run] pnpm update ws -r → >=8.21.0

══════════════════════════════════════════════════════════════════════
  Summary
══════════════════════════════════════════════════════════════════════

  3 to resolve | 1 blocked

  Fixed packages:
     ✓  [update] brace-expansion 5.0.5 → >=5.0.7
     ✓  [update] linkify-it 5.0.1 → >=5.0.2
     ✓  [update] ws 8.18.2 → >=8.21.0

  Risk assessment:
     ▲ high  [override] js-yaml >=4.3.0: major version bump 3.14.2 → 4.3.0, 1 parent(s) may break

  Run with --auto-fix to fix: js-yaml
    (or --apply-overrides for: js-yaml)

  ⚠  DRY RUN — no changes were made. Run without --dry-run to apply.

How this works

1. Analyses all open Dependabot alerts
2. Applies each fix individually with build verification
3. Rolls back any fix that breaks the build
4. Only passing fixes are included in this PR

Review checklist

• Check that no breaking changes were introduced
• Verify rolled-back packages are investigated separately
• Run tests locally if concerned about specific packages