Update dependencies with actionable security alerts

@rzhao271 已经在做这个了。

开始于 2026年9月16日。

• #1792 来自 @copilot-swe-agent —— 已关闭，未合并

## Dependency updates

| Dependency | Current version | Required version |
| --- | --- | --- |
| `brace-expansion` | `1.1.14` | `1.1.17` |
| `brace-expansion` | `2.1.0` | `2.1.3` |
| `brace-expansion` | `5.0.6` | `5.0.8` |
| `js-yaml` | `4.2.0` | `4.3.2` |

Please update the dependencies listed above to at least the required versions.

### Requirements

- Do not use force flags, dependency-resolution overrides, or equivalent mechanisms to bypass
compatibility or security checks.
- Set the minimum required age for dependency versions to 7 days.
- Keep the changes focused on these dependency updates and any directly required lockfile changes.
- Run the repository's relevant tests and validation after making the updates.