chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped axios from ^1.15.2 to ^1.18.0 to resolve 6 CVEs (alerts feat: Add search params to variable and feature commands #265-Log error if login port is in use #269, #272; medium/high severity)
• Changed js-yaml from exact pin 4.1.1 to range ^4.2.0 and added a ^4.1.0 resolution mapping to ^4.2.0 to cover transitive consumers (alert feat: Add pagination flags to variable list and get commands #264; medium) — both now resolve to a single 4.3.0 instance
• Added brace-expansion@npm:^5.0.5 resolution ^5.0.7 to fix the 5.x vulnerable range (alert feat: add dvc identity get command #270; high — DoS via exponential-time expansion)
• Added body-parser@npm:^2.2.1 resolution ^2.3.0 to fix transitive dep via express (alert #271; low)
• Alert fix: Return empty string when token refresh fails #263 (sigstore high) is not resolved: the vulnerable sigstore@1.9.0 is a transitive devDep (oclif -> yeoman-generator -> pacote@15.2.0 -> sigstore@^1.3.0) and no patched 1.x version exists; the only fix would be a major-version bump to 4.x which breaks pacote@15.2.0

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	b812ec0	Jul 23 2026, 01:50 PM

[Copilot]

Pull request overview

Updates JavaScript dependencies and Yarn resolutions/lockfile entries to address multiple Dependabot security alerts in the DevCycle CLI.

Changes:

• Bump axios to ^1.18.0 (and align related Yarn resolutions / lockfile).
• Bump js-yaml to 4.2.0 and add a Yarn resolution for transitive consumers.
• Update Yarn resolutions (and lockfile) for brace-expansion and body-parser to patched versions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates direct dependencies and adds/adjusts Yarn resolutions to force patched transitive versions.
yarn.lock	Regenerates lock entries to reflect the updated versions and resolution outcomes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jonathannorris]

Fixed in b812ec0: changed the direct dependency from the exact pin js-yaml: 4.2.0 to the range js-yaml: ^4.2.0. Now both the direct dep and the js-yaml@npm:^4.1.0 resolution use ^4.2.0, so Yarn deduplicates them to a single 4.3.0 instance — no two-version tree.