chore(deps): fix pnpm audit DoS advisories (js-yaml, @babel/core)

[cernadasjuan]

What

Clears the two advisories currently reported by pnpm audit. Both are dev-tree transitives (jest / semantic-release tooling); the published package's runtime deps (got, jsonwebtoken) are untouched, so this has zero impact on consumers.

Advisory	Sev	Package	Vulnerable	Fix
GHSA arbitrary file read via sourceMappingURL	LOW	@babel/core	<=7.29.0	7.29.7
GHSA-h67p-54hq-rp68 — quadratic-complexity DoS in merge-key handling	MODERATE	js-yaml	<=4.1.1	4.2.0

Approach — parent update first, override only where forced

Per the policy in pnpm-workspace.yaml (prefer upgrading the parent over an override):

• @babel/core → updated in place, no override. Both installed copies (7.25.2, 7.29.0) were stale lockfile resolutions; every consumer (istanbul-lib-instrument ^7.23.9, @babel/helper-module-transforms ^7.0.0, babel-jest) accepts ^7, so pnpm update @babel/core -r converged them to a single 7.29.7 within range.
  • This also let the @babel/helpers: 7.29.2 override be removed — @babel/core@7.29.7 now pulls a patched @babel/helpers ^7.29.7 natively, so the override was both stale (older than its parent) and redundant.
• js-yaml → override required, bumped 4.1.1 → 4.2.0. The only consumers are an unmaintained parent pinned to a different major (@istanbuljs/load-nyc-config → ^3.13.1) and cosmiconfig@9 (^4.1.0); neither pulls a fix on its own, so the existing override is the right tool. 4.2.0 is the actual fixed release — no 4.1.2 was ever published despite the advisory's normalized >=4.1.2 range.

Housekeeping

• Removed the expired brace-expansion minimumReleaseAgeExclude (its Remove after 2026-05-22 window has closed). Leaving it would permanently bypass the 14-day maturity gate for that package — exactly the anti-pattern the file warns about. brace-expansion@5 stays pinned at 5.0.6 via override and resolves on its own.

Verification

• pnpm audit → No known vulnerabilities found
• pnpm audit signatures → 688 packages have verified registry signatures
• pnpm install --frozen-lockfile → lockfile passes supply-chain policies
• pnpm build → ✅
• pnpm test → 54/54 passing

🤖 Generated with Claude Code

[jhonatan-pluggy]

LGTM