fix(deps): bump undici, fast-uri, brace-expansion to patched versions (alerts #257-261)

[osama-rizk]

Problem

Five new Dependabot alerts on transitive dependencies in the root yarn.lock:

• ci: add React Native E2E tests to pipeline #261 (medium) — undici CRLF injection via blob-like body
• ci: add Next.js E2E tests to pipeline #260 (medium) — undici cookie attribute injection via unsanitized values
• E2E draft #259 (medium) — undici downstream response desynchronization
• feat: Add AI generation routes to client #258 (high) — fast-uri host confusion via backslash
• fix: custom selection set return value for custom type arrays #257 (high) — brace-expansion DoS via unbounded intermediate arrays

Issue number, if available: Dependabot alerts #257, #258, #259, #260, #261

These undici alerts are on the undici@^6.23.0 tree, which is separate from the undici@^7.24.5 tree already fixed in #779.

Changes

• undici (^6.23.0) 6.27.0 → 6.28.0 (E2E draft #259/ci: add Next.js E2E tests to pipeline #260/ci: add React Native E2E tests to pipeline #261)
• fast-uri 3.1.4 → 3.1.5 (feat: Add AI generation routes to client #258)
• brace-expansion 5.0.8 → 5.0.9 (fix: custom selection set return value for custom type arrays #257) — also bumps the resolutions pin (^5.0.8 → ^5.0.9) so the enforced version and lockfile agree

All within existing ranges; undici/fast-uri have no dependencies and brace-expansion keeps balanced-match ^4.0.2, so nothing else in the tree shifts. Checksums regenerated with Yarn 4.

Consolidates the three Dependabot PRs #778 (undici), #781 (brace-expansion), #782 (fast-uri). Notably, #781 fails CI (prebuild) because it updated only the resolutions pin in package.json without regenerating yarn.lock, so the immutable install rejects it with "The lockfile would have been modified by this install, which is explicitly forbidden." This PR fixes that by updating both the pin and the lockfile together.

Validation

• yarn install --immutable — passes (exit 0, no YN0028), confirming the lockfile is consistent — the exact check chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 #781 fails.
• Confirmed each target is the first patched version for its advisory and satisfies the existing range.
• Diff is limited to the three lockfile blocks (version / resolution / checksum) plus the one resolutions pin line for brace-expansion.

This is a dependency-only security fix; no source or test changes apply.

Checklist

• PR description included
• yarn test passes (CI)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 01dbf9b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR