Security enhancements

[TwitchBronBron]

Clears all 5 high-severity advisories that were failing the security-audit gate, plus one moderate.

npm audit --omit=dev: 1 moderate (uuid, already allowlisted) — unchanged, because every advisory fixed here is dev-only.

Ships to consumers

None. No dependencies entry changed, so downstream projects are unaffected either way.

Lockfile only (dev deps)

Package	Was	Now	Advisory	Pulled in by
brace-expansion	1.1.16	1.1.18	GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895	eslint-plugin-import
brace-expansion	2.1.2	2.1.4	GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895	mocha
fast-uri	3.1.4	3.1.5	GHSA-7p8r-x3mc-p8w7	ajv
js-yaml	3.15.0	3.15.1	GHSA-5p4m-2wfm-xmqj	nyc
js-yaml	4.3.0	4.3.1	GHSA-5p4m-2wfm-xmqj	eslint, mocha
nanoid	3.3.16	3.3.18	GHSA-2v37-7h3g-55p8	madge
postcss	8.5.22	8.5.26	GHSA-fxqj-rqcc-2cmp	madge

Notes for the reviewer

• All seven are patch bumps within the parent's existing range, applied as overrides since no fixed parent release exists. Consumers don't inherit overrides, but that's moot here — nothing vulnerable is reachable through our dependencies.
• postcss was a moderate and below the gate's high floor, so it wasn't required. Included because it was a free patch bump in the same dev subtree.
• uuid (GHSA-w5hq-g745-h8pq) stays deferred — the only fix is a breaking uuid@14 major on roku-deploy's transitive. The existing allowlist entry documents why the v3/v5/v6 buffer path is unreachable. Recommend leaving it.

Verification

npm run preversion (build + lint + 4292 tests) passes, and npm run audit reports "Passed npm security audit."

🤖 Generated with Claude Code