fix(deps): runtime dependency security fixes

[javascript-sdk-gitflow]

Summary

Batched runtime dependency security fixes. One commit per vulnerability.

Fixes

• brace-expansion 1.1.11 → 1.1.16 — GHSA-3jxr-9vmj-r5cp / CVE-2026-13149 (high) — https://github.com/getsentry/sentry-javascript/security/dependabot/2060

🤖 Generated with Claude Code

[sentry]

Bug: The security fix is incomplete as the yarn.lock file still contains a reference to the vulnerable brace-expansion@5.0.6 package.
_{Severity: HIGH}

Suggested Fix

Identify which package has a dependency on the exact version brace-expansion "5.0.6". Update that package's dependency to point to a patched version (e.g., ^5.0.7) or remove it if it's no longer needed. Regenerate the yarn.lock file to ensure the vulnerable version is fully removed.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: yarn.lock#L11888-L11893

Potential issue: The pull request, intended to fix a security vulnerability
(GHSA-3jxr-9vmj-r5cp) in the `brace-expansion` package, is incomplete. While most
dependency ranges for `brace-expansion` were updated, the `yarn.lock` file still
contains an entry for the vulnerable version `brace-expansion@5.0.6`. A dependency
specification explicitly requires this exact version. If the package requiring this
version is a runtime dependency, the application will remain exposed to the security
vulnerability that this pull request was meant to resolve.

_{Did we get this right? 👍 / 👎 to inform future reviews.}