fix(dependencies): Update Autter-dev/autter-cli

[autter-dev]

Draft adaptation for a third-party vendor API change detected by Autter.

Vendor change

• Service: dependencies (production)
• Signature: Update Autter-dev/autter-cli

CVEs added in this project

• brace-expansion@5.0.6 HIGH — Autter-dev/autter-cli · GHSA-rgw5-rvv9-x895 · update to 1.1.18
• brace-expansion@5.0.6 HIGH — Autter-dev/autter-cli · GHSA-6j4f-fj2g-mc7p · update to 5.0.10
• brace-expansion@5.0.6 HIGH — Autter-dev/autter-cli · GHSA-qhr7-859c-m2p7 · update to 5.0.11
• brace-expansion@5.0.6 HIGH — Autter-dev/autter-cli · GHSA-mh99-v99m-4gvg · update to 5.0.8
• fast-uri@3.1.2 HIGH — Autter-dev/autter-cli · GHSA-v2hh-gcrm-f6hx · update to 2.4.3
• fast-uri@3.1.2 HIGH — Autter-dev/autter-cli · GHSA-7p8r-x3mc-p8w7 · update to 2.4.4
• fast-uri@3.1.2 HIGH — Autter-dev/autter-cli · GHSA-f65p-4m7j-42xc · update to 2.4.5
• fast-uri@3.1.2 HIGH — Autter-dev/autter-cli · GHSA-fph4-wmhf-6fwf · update to 2.4.5
• fast-uri@3.1.2 HIGH — Autter-dev/autter-cli · GHSA-jqff-g426-hqxp · update to 2.4.5
• fast-uri@3.1.2 HIGH — Autter-dev/autter-cli · GHSA-qw65-cvwx-89v3 · update to 2.4.6
• fast-uri@3.1.2 HIGH — Autter-dev/autter-cli · GHSA-4c8g-83qw-93j6 · update to 4.0.1
• form-data@4.0.5 HIGH — Autter-dev/autter-cli · GHSA-hmw2-7cc7-3qxx · update to 2.5.6
• gix-fs@0.19.1 HIGH — Autter-dev/autter-cli · GHSA-f89h-2fjh-2r9q · update to 0.21.1
• gix-validate@0.11.0 HIGH — Autter-dev/autter-cli · GHSA-p3hw-mv63-rf9w · update to 0.11.1
• js-yaml@4.1.1 HIGH — Autter-dev/autter-cli · GHSA-52cp-r559-cp3m · update to 3.15.0
• js-yaml@4.1.1 HIGH — Autter-dev/autter-cli · GHSA-5p4m-2wfm-xmqj · update to 4.3.1
• js-yaml@4.1.1 HIGH — Autter-dev/autter-cli · GHSA-2883-xcg3-v3hh · update to 4.3.2
• linkify-it@5.0.1 HIGH — Autter-dev/autter-cli · GHSA-v245-v573-v5vm · update to 5.0.2
• serialize-javascript@6.0.2 HIGH — Autter-dev/autter-cli · GHSA-5c6j-r48x-rmvq · update to 7.0.3
• tmp@0.2.5 HIGH — Autter-dev/autter-cli · GHSA-ph9p-34f9-6g65 · update to 0.2.6
• toml@4.1.1 HIGH — Autter-dev/autter-cli · GHSA-v5mp-jgw5-2x6j · update to 4.1.2
• toml@4.1.1 HIGH — Autter-dev/autter-cli · GHSA-82x6-q7mm-w9cf · update to 4.2.0
• undici@7.25.0 HIGH — Autter-dev/autter-cli · GHSA-vxpw-j846-p89q · update to 6.27.0
• undici@7.25.0 HIGH — Autter-dev/autter-cli · GHSA-rfgv-xxqx-mfg5 · update to 6.28.1
• undici@7.25.0 HIGH — Autter-dev/autter-cli · GHSA-hm92-r4w5-c3mj · update to 7.28.0
• undici@7.25.0 HIGH — Autter-dev/autter-cli · GHSA-vmh5-mc38-953g · update to 7.28.0
• undici@7.25.0 HIGH — Autter-dev/autter-cli · GHSA-4cwx-7wf7-3272 · update to 7.29.0
• undici@7.25.0 HIGH — Autter-dev/autter-cli · GHSA-w293-vg96-wgc3 · update to 7.29.1

Why this repo is hit

Scheduled repository update for vendor API changes and known CVEs.

What this PR changes

Updated 10 packages to address CVEs: npm packages (brace-expansion, fast-uri, form-data, js-yaml, linkify-it, serialize-javascript, tmp, undici) and Rust packages (gix-fs, gix-validate). Note: toml crate was not updated as current version 0.9.8 differs from CVE reference (4.1.x).

Remediation safety and rollback

Actual changed files: Cargo.lock, agent-support/vscode/package-lock.json

code fix: Apply every listed update in one change on branch autter/fix-updates. Do not open a separate pull request. Do not add packages that are not already dependencies. You may edit the lockfile only for: brace-expansion, fast-uri, form-data, gix-fs, gix-validate, js-yaml, linkify-it, serialize-javascript, tmp, toml, undici.

• Verify the diagnosis against the current repository and prepare a draft PR with the smallest correct change.

Blast radius (unknown): The available analysis has not established the impact on shared callers, users, or data. Prepare the draft automatically; a human must assess these before merge or production rollout.

The actual draft also changes 2 file(s) outside the assessed scope: Cargo.lock, agent-support/vscode/package-lock.json. Their downstream impact is unknown and requires human rollout review.
Affected: Cargo.lock, agent-support/vscode/package-lock.json, dependencies

Rollback strategy: Before merge, close the draft PR and discard its branch. If deployed later, revert the fix commit through a reviewed PR and redeploy the previous compatible release. Confirm data/schema compatibility before reverting and verify recovery using the original failure signal.

If this draft is abandoned, close the PR. If deployed later, revert the complete patch, including the additional files, through a reviewed PR; check data/schema compatibility and verify the original failure signal recovers.

Validation required:

• Reproduce the original failure, run the relevant regression tests and CI, and verify affected callers. After an operator deploys, compare error rate and latency against the pre-change baseline.
• Review downstream callers and regression coverage for all files changed beyond the original RCA scope.

Temporary regression tests

The fix agent did not return a test report. Test status and cleanup could not be confirmed; the fix PR was still opened.

---

Opened as a draft by Autter. Deprecated packages, breaking API changes, newer API versions, and CVE bumps for this repository land together on autter/fix-updates. The next day adds a commit to this pull request. Review carefully before merging.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}