chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 4 open Dependabot security alerts by bumping vulnerable dependencies via resolutions (and the direct js-yaml dependency)

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#299	nanoid	high	Bumped to 3.3.18 via resolutions
#298	js-yaml	high	Bumped to 4.3.1 via direct dependency bump + resolutions
#297	js-yaml	high	Bumped to 3.15.1 via resolutions
#296	nanoid	high	Bumped to 5.1.16 via resolutions

[cloudflare-workers-and-pages]

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	423e4da	Aug 12 2026, 01:28 PM

[Copilot]

Pull request overview

Updates dependency versions to resolve Dependabot security alerts in this Yarn-managed TypeScript CLI by bumping js-yaml directly and enforcing patched transitive versions via resolutions.

Changes:

• Bumped direct js-yaml dependency to ^4.3.1.
• Added/updated resolutions to force patched versions of js-yaml (3.x and 4.x ranges) and nanoid (3.x and 5.x ranges).
• Regenerated yarn.lock to reflect the resolved versions (js-yaml 3.15.1 / 4.3.1, nanoid 3.3.18 / 5.1.16).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Bumps direct js-yaml and adds Yarn resolutions to force patched transitive versions for Dependabot alerts.
yarn.lock	Locks the dependency graph to the updated js-yaml and nanoid versions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.