[RGood]

Summary

Fixes nine open Dependabot alerts (M12) with a lockfile refresh. No resolutions override and no package.json change.

Package	Lockfile change	Alerts fixed
brace-expansion 1.x	1.1.18 → 1.1.21	#119 (medium), #134, #135 (high)
brace-expansion 2.x	2.1.4 → 2.1.7	#112, #114 (high), #113 (medium)
express (brings qs)	express 4.22.2 → 4.22.3	#101, #104, #150 (medium)

Details

• All of these are inside existing ranges, so the lockfile was just stale. yarn up -R brace-expansion express updates it.
• express 4.22.2 depended on qs ~6.15.1, which kept a vulnerable qs 6.15.3 copy. express 4.22.3 depends on qs ~6.16.0, so that copy drops out and only qs 6.16.2 remains.
• express 4.22.3 also updates its own dependency path-to-regexp (0.1.12 → 0.1.13, within its range). express is pulled in only by webpack-dev-server (local development).
• Chosen versions are at or above every fix. npm lists newer patch releases (1.1.22, 2.1.8); Yarn resolved 1.1.21 and 2.1.7, which cover all six brace-expansion alerts.
• yarn.lock only (12 additions, 22 deletions).

Verification (local, with the repo's pinned Yarn 4.18.0)

• yarn install --immutable passes.
• Full yarn build succeeds with the same warnings as main (5 HTML minifier diagnostics, 2 broken anchors) and the same number of output files (11,610).

Testing

CI build should pass. After merge, confirm the Pages deploy succeeds and that the nine alerts close.

Not included

• uuid v0.12.17 release #73: pinned by sockjs 0.3.24 (its final release, via webpack-dev-server, dev only); the fix is a major bump that needs an override, so it is handled separately.
• serialize-javascript, minimatch, glob, deepmerge alerts.

Part of M12 (fix dependency alerts).