deps: patch js-yaml and brace-expansion DoS advisories

[riglar]

pnpm audit --audit-level moderate is failing CI on three high advisories (seen on #94's run, but it fails on every branch — the advisories landed 2026-07-24).

Two commits: the dependency fix, plus a one-line CI fix needed to break a merge deadlock (explained at the bottom).

1. deps: the advisories

Advisory	Package	Fix
GHSA-pm4m-ph32-ghv5	js-yaml 5.2.1	→ 5.2.2
GHSA-mh99-v99m-4gvg	brace-expansion 5.0.7	→ 5.0.8 (override range widened)
GHSA-mh99-v99m-4gvg	brace-expansion 1.1.16	path removed — see below

js-yaml (exponential parsing time in flow collections) is the one that matters at runtime: js-yaml parses user Maestro flow files, so a malformed flow could hang the CLI. Declared range bumped to ^5.2.2 and a transitive pnpm.overrides guard added alongside the existing 3.x/4.x entries, matching the tar precedent.

brace-expansion (unbounded expansion length → uncatchable OOM) resolved to 5.0.7 under the existing >=3.0.0 <5.0.7 override; widened to <5.0.8.

Why eslint-plugin-import is dropped

The second brace-expansion finding is eslint-plugin-import → minimatch@3 → brace-expansion@1.1.16, and it can't be overridden:

• Upstream published no 1.x or 2.x backport — maintenance-v1 is still 1.1.16 and maintenance-v2 is 2.1.2, both inside the vulnerable <=5.0.7 range. Only 5.0.8 is patched.
• Forcing 5.x into that path breaks it: v5 exports { expand }, but minimatch@3 does var expand = require('brace-expansion') and calls it.
• Overriding minimatch@3 → 10.x breaks differently — minimatch 10's CJS build has no callable default, so eslint-plugin-import's _interopRequireDefault(...)(…) would throw.

eslint.config.cjs registered the plugin with no rules enabled, purely so legacy import/… disable comments resolve, and exactly one such comment was left (src/methods.ts — itself already a dead directive, since neither import/namespace nor new-cap is on). So the plugin is removed along with that half of the comment. That deletes the entire minimatch@3 → brace-expansion@1.x subtree (~1000 lines of lockfile) and avoids adding the GHSA to ignoreGhsas, which would also have silenced the fixable 5.x path.

2. ci: scope the gitleaks scan to the branch under test

The first push here failed secret-scan on bfa2b4c — a commit that is not on this branch. Cause: fetch-depth: 0 fetches refs/heads/* (every branch) and gitleaks git scans all reachable commits, not just the checked-out ref. #94 pins two KEK public keys and allowlists them in the same branch, so it fails every other branch's scan, which is judged against the allowlist at its own tip.

That is a hard deadlock, since secret-scan and lint-and-test are both required checks on dev:

• this PR ← blocked by secret-scan, needs feat: client-side envelope encryption of binaries, flow zips & env vars #94's allowlist on dev
• feat: client-side envelope encryption of binaries, flow zips & env vars #94 ← blocked by lint-and-test, needs this PR's audit fix on dev

--log-opts=HEAD limits the scan to commits reachable from what's checked out — the full history of the branch, or of the PR merge commit (base + PR commits). Coverage is unchanged in the way that matters: every commit of the branch under test is still scanned, each branch is still fully scanned by its own PR, and pushes to dev/production still scan their full history.

Verified with the pinned gitleaks 8.30.1 locally:

• scoped to this branch → 61 commits, no leaks
• scoped to feat/binary-envelope-encryption using this branch's allowlist → the same 2 findings still fire

So the change narrows which commits are in scope without weakening detection. (--config=/dev/null was my first sanity check and was invalid — an empty config disables the ruleset, so it reports clean regardless.)

Notes

• No other dependency resolutions change — verified against git show dev:pnpm-lock.yaml. The pre-existing picomatch unmet-peer install warning is unrelated and unchanged.
• The remaining ignored moderate (@hono/node-server, GHSA-frvp-7c67-39w9) is untouched: @modelcontextprotocol/sdk is already at its latest release, so there's no fix to take.
• ⚠️ feat: client-side envelope encryption of binaries, flow zips & env vars #94 and feat(artifacts): prefer server-assembled bundle delivery for downloads #93 will keep failing the audit until they pick up dev after this merges.

Verification

pnpm install --frozen-lockfile ✅ (the flag CI uses) · pnpm audit --audit-level moderate ✅ exit 0, only the pre-existing ignored moderate · pnpm lint ✅ · pnpm typecheck ✅ · pnpm build ✅ · pnpm test ✅ 167 passing · CI lint-and-test ✅ green on the first push

🤖 Generated with Claude Code

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.