Audit: track js-yaml + brace-expansion high-severity vulns (transitive dev tooling)

[Trosper3]

Problem

Two more high-severity npm audit findings, both transitive dev dependencies pulled in via the ESLint toolchain (not production code):

• js-yaml 4.0.0–4.3.0 — GHSA-5p4m-2wfm-xmqj (quadratic CPU consumption in !!omap resolution).
• brace-expansion — GHSA-3jxr-9vmj-r5cp / GHSA-mh99-v99m-4gvg / GHSA-rgw5-rvv9-x895 (DoS via expansion), present in multiple nested copies (@eslint/config-array, @eslint/eslintrc, eslint, eslint-config-next).

Tracked separately from svgo (#186) since this is dev-tooling-only exposure with a different remediation path (bumping ESLint/eslint-config-next versions, not swapping a production package).

Investigation done

npm audit fix / npm audit fix --force do not resolve either — no patched version currently published for the vulnerable range.

Action

No code change is actionable today. Re-check npm audit periodically and bump eslint / eslint-config-next once upstream ships fixed versions that pull in patched js-yaml/brace-expansion.

Acceptance

npm audit no longer reports these advisories.