fix(security): bump vulnerable transitive dev deps to patched versions

[rlorenzo]

Summary

Patches the 5 open high-severity Dependabot alerts. All are transitive dev-only dependencies (build/lint/test tooling), never shipped to the browser bundle or the .NET runtime.

Dependabot alert	Package	Fix
#142	shell-quote (root)	concurrently 10.0.3 -> 10.0.4, which moves its exact pin to 1.9.0
#141	js-yaml (root)	npm update to 4.3.0
#137	shell-quote (VueApp)	same concurrently bump (1.10.0 top-level for npm-run-all2, 1.9.0 nested)
#136, #134	brace-expansion (VueApp)	npm update to 2.1.2 / 5.0.7

All are DoS / quadratic-complexity (ReDoS-style) advisories. Exploitation requires feeding attacker-controlled input to the vulnerable parser, which does not happen in dev tooling.

Why bump concurrently

concurrently@10.0.3 declares an exact "shell-quote": "1.8.4", so npm update cannot lift it and alerts #142 and #137 stay open. Version 10.0.4 moves that pin to shell-quote@1.9.0, clearing both at the source.

The other four alerts need no such intervention. Their parents already permit the patched versions (cosmiconfig allows js-yaml ^4.1.0, minimatch allows brace-expansion ^5.0.5 / ^2.0.2), so these were stale lockfile entries that a plain npm update re-resolves.

The only runtime change in concurrently 10.0.4 is adding .unref() to the force-kill timer in kill-others.ts. That timer is only created when a kill-timeout is configured, which none of our scripts pass, so the path is inert here.

Note on min-release-age

Our .npmrc sets min-release-age=7. concurrently@10.0.4 was published 2026-07-24 and is still inside that window, so the lockfiles were resolved with the gate bypassed for this one install.

The release was reviewed by hand first: 6 commits, 5 files, +46/-36, no install hooks (none present before or after), no new dependencies, no new network calls, published via GitHub Actions OIDC with npm provenance. No advisories against concurrently or against shell-quote 1.9.0.

npm ci installs the resulting lockfile without needing the bypass, so CI is unaffected.

Verification

• Pre-commit hook: LINT + TEST + VERIFY all passed.
• VueApp: 55 test files / 799 tests pass; npm run build (type-check + vite via run-p) succeeds.
• Lockfile churn is limited to concurrently in both workspaces plus the two shell-quote entries. No unrelated bumps, no packages added or removed.
• npm audit output is identical before and after this change in both workspaces, so it introduces nothing new.

[codecov-commenter]

Bundle Report

Bundle size has no change ✅

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.38%. Comparing base (f9ed67b) to head (6742f56).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #268   +/-   ##
=======================================
  Coverage   45.38%   45.38%           
=======================================
  Files         916      916           
  Lines       52787    52787           
  Branches     5005     5005           
=======================================
  Hits        23960    23960           
  Misses      28199    28199           
  Partials      628      628           

Flag	Coverage Δ
backend	45.42% <ø> (ø)
frontend	44.72% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

Updates transitive dev-only npm dependencies to patched versions in order to resolve the currently open high-severity Dependabot alerts, without introducing runtime/browser-shipped dependency changes.

Changes:

• Bump concurrently to ^10.0.4 in both root and VueApp, pulling in patched shell-quote@1.9.0 under concurrently.
• Refresh lockfiles to lift js-yaml to 4.3.0 (root) and brace-expansion to 2.1.2 / 5.0.7 (VueApp).

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File	Description
package.json	Bumps root dev dependency concurrently to 10.0.4.
package-lock.json	Updates resolved concurrently, shell-quote, and js-yaml entries to patched versions.
VueApp/package.json	Bumps VueApp dev dependency concurrently to 10.0.4.
VueApp/package-lock.json	Updates resolved concurrently, shell-quote, and brace-expansion entries to patched versions.

Files not reviewed (1)

• VueApp/package-lock.json: Generated file