chore(deps): re-resolve orphaned security alerts within existing ranges

[yumike]

Closes Dependabot alerts #15, #16, #67, #85, #87, #122.

Why these were stuck

Dependabot files one PR per package name, not per alert. When a package is vulnerable on two major lines it fixes one and leaves the other open indefinitely:

Fixed by	Left behind
#146 — form-data 2.x → 2.5.6	form-data 4.x stuck at 4.0.5 (#67)
#133 — js-yaml 3.x → 3.15.1	js-yaml 4.x stuck at 4.3.0 (#122)
#142 — brace-expansion 1.x → 1.1.18	brace-expansion 2.x and 5.x (#87, #85)

js-yaml #122 has sat open since 07 Aug while ~15 other Dependabot PRs went out, so these will not resolve themselves.

What this does

Every one of these is reachable from ranges already declared, so yarn up -R lifts them without touching any manifest:

yarn up -R form-data js-yaml brace-expansion picomatch

Package	Range	Before → After	Alert
brace-expansion	^2.0.1, ^2.0.2	2.0.2 → 2.1.4	#87
brace-expansion	^5.0.2	5.0.4 → 5.0.9	#85
form-data	^4.0.0, ^4.0.5	4.0.5 → 4.0.6	#67
js-yaml	^4.1.0, ^4.2.0	4.3.0 → 4.3.1	#122
picomatch	^2.0.4 …	2.3.1 → 2.3.2	#16
picomatch	^4.0.2, ^4.0.3	4.0.3 → 4.0.5	#15

Lockfile-only: 21 insertions, 21 deletions, no packages added or removed, no majors crossed. brace-expansion 1.x and js-yaml 3.x are deliberately absent — #142 and #133 already put them at their highest in-range versions.

One incidental line

-"mime-types@npm:^2.1.12, ^2.1.27, ^2.1.35, ~2.1.24, ~2.1.34, ~2.1.35":
+"mime-types@npm:^2.1.27, ^2.1.35, ~2.1.24, ~2.1.34, ~2.1.35":

The descriptor list shrinks because form-data 4.0.6 raised its own floor from mime-types: ^2.1.12 to ^2.1.35. The resolved mime-types version is unchanged at 2.1.35 — cosmetic, nothing moved.

Verification

picomatch and brace-expansion are the glob engines under jest, eslint and webpack, so this got the full pipeline rather than a lockfile glance:

Check	Result
yarn install --immutable	✅ no drift
yarn typecheck	✅
yarn build	✅
yarn lint	✅
yarn test	✅ 588 tests
yarn format:check	✅
yarn workspace app build	✅

The last row matters: CI's yarn build is scoped to --include '@rwdocs/*', so it never bundles the frontend app. Ran explicitly.

Notes

• All six alerts are dev/test-scoped (@backstage/cli tooling, supertest, eslint/jest globbing), so this is hygiene rather than urgent — it just clears alerts that would otherwise never close.
• Takes open alerts from 27 → 21, and also resolves several auto-dismissed brace-expansion alerts (rw-backend: the markdown route doesn't enforce the visibility permission the search collator stamps #108–Search filters docs per claiming entity, but the read path gates on the site entity #113).
• No package.json changes, no resolutions overrides.

🤖 Generated with Claude Code