chore: resolve open dependabot security alerts

[jonathannorris]

Summary

Resolved 3 of 4 open Dependabot security alerts by bumping vulnerable dependencies via yarn resolutions.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#280	brace-expansion	high	Resolution bumped to ^5.0.8; resolves to 5.0.9
#279	tar	medium	Resolution bumped to ^7.5.21; resolves to 7.5.22
#278	postcss	high	Resolution bumped to ^8.5.18; resolves to 8.5.25

Unresolved Alert

Alert	Package	Severity	Reason
#276	sharp	high	Previously reverted in #580 due to LGPL-licensed libvips artifact bundled in sharp 0.35.x prebuilds. Requires manual investigation before re-attempting.

Test plan

• yarn build passes
• yarn test:ci passes (44 test files, 189 tests)
• Lockfile resolves all three packages to patched versions

[Copilot]

Pull request overview

This PR addresses Dependabot-reported security vulnerabilities by updating Yarn resolution overrides so transitive dependencies resolve to patched versions across the CLI.

Changes:

• Bump brace-expansion via Yarn resolutions to ^5.0.8 (lockfile resolves to 5.0.9).
• Bump tar via Yarn resolutions to ^7.5.21 (lockfile resolves to 7.5.22).
• Bump postcss via Yarn resolutions to ^8.5.18 (lockfile resolves to 8.5.25, including updated transitive nanoid range).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Updates Yarn resolutions entries to force patched versions of vulnerable transitive dependencies.
yarn.lock	Updates lockfile entries so the resolved versions match the new patched resolution targets.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cloudflare-workers-and-pages]

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	da041f4	Jul 30 2026, 01:45 PM