chore(deps): resolve current security advisories

[corwinm]

Summary

• advance the existing brace-expansion 5.x security override from 5.0.8 to 5.0.9 and expand its vulnerable selector boundary
• advance the existing fast-uri 3.x security override from 3.1.5 to 3.1.7 and expand its vulnerable selector boundary, resolving all four open Dependabot alerts
• add a narrow typed-rest-client>qs override to 6.16.0 because the maintained VS Code packaging parent still resolves typed-rest-client@1.8.11, whose ^6.9.1 range otherwise locks to vulnerable qs@6.15.2
• keep direct dependencies and major versions unchanged

Security evidence

Fresh audit on origin/main (dcfc27e): 7 findings — 5 high and 2 moderate.

• brace-expansion@5.0.8: GHSA-rgw5-rvv9-x895 (high)
• fast-uri@3.1.5: GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp (high)
• qs@6.15.2: GHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g (moderate)

Post-change pnpm audit --json: 0 vulnerabilities across all severities.

pnpm why confirms the affected paths now resolve only:

• brace-expansion@5.0.9 on the 5.x line (legacy 1.x/2.x lines remain on their separately patched overrides)
• fast-uri@3.1.7
• qs@6.16.0

Verification

• pnpm install --frozen-lockfile
• pnpm audit --json
• pnpm why brace-expansion
• pnpm why fast-uri
• pnpm why qs
• pnpm test — 26 passing in a real VS Code 1.136.1 extension host
• pnpm run package
• pnpm run verify:release
• pnpm exec vsce package --no-dependencies --out /tmp/oil-code-security-smoke.vsix — valid 130,211-byte VSIX with extension manifest and bundled dist/extension.js
• git diff --check
• independent repository-aware codex review --base origin/main on exact head eedec46c3caf63a00c99971b6dcdcf0e91b4ddcd — no actionable findings

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T23:39:40.140483Z	eedec46	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.