[maxatwork]

Summary

Update the lockfile and dependency-security guards for the actionable security fixes found during the October maintenance pass:

• devalue 5.9.2 -> 5.9.3, addressing Dependabot alerts #84, #85, #86, #87, #88, and #89.
• brace-expansion 1.1.18/2.1.4/5.0.9 -> patched versions, addressing Dependabot alerts #81, #82, and #83.
• sharp 0.35.4 -> 0.35.5 (GHSA-wq5f-xc86-pv6w).
• smol-toml 1.7.1 -> 1.9.1 (GHSA-r4xh-jqrq-34v2).
• source-map-js 1.2.1 -> 1.2.2 (GHSA-68fv-2mgg-jv7q).

Boundary tests and lockfile assertions are updated so these minimum versions remain enforced.

Verification

• npm ci --ignore-scripts
• npm run test:packages
• npm run test:integration (45 tests)
• npm run lint
• npm run typecheck
• npm run build
• npm run pack:dry-run
• DOCS_E2E_HOST=127.0.0.1 DOCS_E2E_PORT=4329 npm -w @form2js/docs run test:e2e -- --reporter=line (3 passed)

Full npm audit still reports the pre-existing @changesets/cli 2.x development-tool chain and the disputed http-cache-semantics advisory; those require separate policy/compatibility decisions and are intentionally not changed here.

Please review and merge manually if the required checks remain green. This PR is intentionally not configured for automatic merge.

---

Summary by cubic

Bumps several vulnerable transitive dependencies to patched versions and updates the dependency-security test so the new minimum versions stay enforced.

• devalue 5.9.2 → 5.9.3
• brace-expansion bumped across the 1.x, 2.x, and 5.x ranges
• sharp 0.35.4 → 0.35.5
• smol-toml 1.7.1 → 1.9.1
• source-map-js 1.2.1 → 1.2.2 (new override)
• Security test's semver comparison now handles prerelease identifiers, so patch-level boundaries with prereleases are classified correctly.

Known advisories for @changesets/cli 2.x and http-cache-semantics remain untouched pending separate compatibility decisions.

^{Written for commit 5296873. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T09:53:37.677331Z	53c6b63	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>