deps: bump the security-development group across 1 directory with 3 updates

[dependabot]

Bumps the security-development group with 3 updates in the / directory: brace-expansion, browserslist and js-yaml.

Updates brace-expansion from 1.1.15 to 1.1.21

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

Updates browserslist from 4.28.2 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

Changelog

Sourced from browserslist's changelog.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improved or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

Commits

• b4809dd Release 4.29.3 version
• 9d844f8 Update Firefox ESR
• 0033f34 Update dependencies
• 906d329 Release 4.29.2 version
• ff8c83f Update dependencies
• 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
• f760921 Do not add versions without usage data to cover queries
• 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
• 1e5356f Note that Android version queries return only the latest version
• 5b7e941 Add missed changes to ChangeLog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates js-yaml from 4.2.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Commits

• 79ca68d 4.3.2 released
• d90b661 Backport merge limits from v5.4.1
• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
arcadeghosts-site	Ready	Preview	Sep 29, 2026 6:11pm UTC