#57 fix(security): patch Aikido-flagged dependencies

Summary

Patch the dependencies that Aikido flagged on sdk-node, plus the rest of the pnpm audit findings in both lockfiles. All fixes are transitive, so they go through same-major overrides. No direct dependency changed. No runtime dependency changed: the root changes are dev-only (jest tree).

Root pnpm-lock.yaml (overrides in pnpm-workspace.yaml)

Package	From	To	Override
brace-expansion	5.0.8	5.0.12	^5.0.12 (was ^5.0.8)
js-yaml (3.x)	3.15.0	3.15.2	'js-yaml@3': '>=3.15.2 <4' (was >=3.15.0)
browserslist	4.28.2	4.29.0	new: 'browserslist@4': '>=4.28.7 <5'
baseline-browser-mapping	2.10.29	2.11.25	new: 'baseline-browser-mapping@2': '>=2.11.0 <3'

The browserslist bump also refreshed its own deps (caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db).

.deepsec/pnpm-lock.yaml (overrides in package.json#pnpm.overrides and pnpm-workspace.yaml, kept in sync)

Package	From	To	Override
undici	7.29.0	7.30.0	>=7.29.1 <8 (was >=7.28.0)
proxy-addr	2.0.7	2.0.8	new: >=2.0.8 <3
ip-address	10.2.0	10.7.2	new: >=10.7.1 <11
brace-expansion	5.0.9	5.0.12	'brace-expansion@>=3': '>=5.0.12 <6' (was >=5.0.8)
fast-uri	3.1.5	3.1.8	>=3.1.8 <4 (was >=3.1.4)
hono	4.12.34	4.13.12	>=4.13.7 <5 (was >=4.12.27)
qs	6.15.3	6.16.0	>=6.16.0 <7 (was >=6.15.2)

proxy-addr, ip-address and undici are only in the .deepsec lockfile. brace-expansion is in both.

Skipped

None. Every fix is inside the current major. All target versions are older than the root minimumReleaseAge (7 days), so no exceptions were needed.

Verification

• pnpm audit root: 9 (7 high, 2 moderate) before, 0 after.
• pnpm audit .deepsec: 32 (10 high, 19 moderate, 3 low) before, 0 after.
• Root: pnpm install --frozen-lockfile, pnpm build, pnpm lint (tsc --noEmit) pass. pnpm test: 34 passed, 4 skipped (the env-gated integration suite, same as main).
• .deepsec: pnpm install --frozen-lockfile passes (pnpm 9.15.4 from packageManager). pnpm deepsec scan loads the config and completes.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}