fix(deps): resolve all open Dependabot security advisories

[nmccready]

Resolves every open Dependabot alert on this repo in one lockfile-only change.

Alerts closed

#	Sev	Package	Advisory	Vulnerable	Patched
46	high	js-yaml	GHSA-5p4m-2wfm-xmqj	>=3.0.0 <3.15.1	3.15.1
41	high	brace-expansion	GHSA-3jxr-9vmj-r5cp	<1.1.16	1.1.16
40	high	js-yaml	GHSA-52cp-r559-cp3m	>=3.0.0 <3.15.0	3.15.0
39	high	brace-expansion	GHSA-3jxr-9vmj-r5cp	>=3.0.0 <5.0.7	5.0.7
38	medium	js-yaml	GHSA-h67p-54hq-rp68	<3.15.0	3.15.0

npm audit locally also flagged three advisories Dependabot had not yet surfaced; those are cleared by the same update:

• @humanfs/node — recursive copy follows symlinked files, copying data from outside the source tree
• browserslist — unbounded memory growth (no cache eviction) → OOM; uncaught crash / prototype write via untrusted browserslist-stats.json
• ws — uninitialized memory disclosure; memory exhaustion from tiny fragments

Changes

Lockfile only — package.json is untouched, so no declared dependency ranges change. Every bump lands inside the existing semver ranges of the parent packages.

js-yaml                        3.14.2 -> 3.15.2
brace-expansion                5.0.2  -> 5.0.9
brace-expansion (glob, nested) 1.1.12 -> 1.1.18
brace-expansion (test-exclude) 1.1.12 -> 1.1.18
@humanfs/node                  0.16.7 -> 0.16.8
@humanfs/core                  0.19.1 -> 0.19.2
browserslist                   4.28.1 -> 4.28.8
ws                             8.19.0 -> 8.21.3
caniuse-lite / electron-to-chromium / node-releases / baseline-browser-mapping / update-browserslist-db — refreshed as browserslist deps

All of these are dev/build-time transitive dependencies. The production dependency tree (debug) is unaffected, so published consumers of angular-simple-logger were never exposed to these — this closes build-chain risk.

Verification

• npm ci from the updated lockfile → clean
• npm audit → 0 vulnerabilities (was 4 high, 1 moderate)
• npm run lint → clean
• npm test → 15/15 passing
• npm run build → rollup emits all bundles, dist/ byte-identical

🤖 Generated with Claude Code