[APS-9999] security omnibus: consolidate cypress-cli dep bumps (APS-21205 · APS-21226)

[jasbir-browserstack]

Summary

Consolidated security PR replacing #1183 so both SLA-tracked CVEs land under a single omnibus branch (matching the same pattern used for the SeleniumHub batch in browserstack/SeleniumHub#14734). No logic changes vs the source — same lockfile diff, freshly branched off current master.

What's in this PR

Source PR	Branch	Scope
#1183	security/APS-21226-21205-dep-bumps-sep2026	Bump vulnerable transitives via npm audit fix (no overrides, no package.json change)

Tickets covered

Ticket	Package	Advisory	Now @
APS-21205	js-yaml	GHSA-52cp-r559-cp3m	3.15.2 / 4.3.2
APS-21226	brace-expansion	GHSA-3jxr-9vmj-r5cp	1.1.18 / 2.1.4

Why land this despite the repo being public

browserstack-cypress-cli runs on customer CI machines and parses customer-supplied inputs:

• browserstack.yml → js-yaml (DoS in merge-key handling; a crafted YAML anchor chain can hang the CI worker)
• Cypress spec / exclude glob patterns → brace-expansion via minimatch (DoS in {} expansion; a crafted glob can hang for minutes)

Not data-exfil, but a customer could accidentally hang their own CI, so the patched transitives are worth landing.

Files

Single-file diff: package-lock.json (+131 / −131). No package.json changes, no runtime code changes.

Test plan

• npm test on branch: 711 passing / 2 pending / 16 failing — matches baseline on master. All 16 failures are pre-existing, no regression from the bump.
• npm audit: neither target advisory resolves against the tree.
• Repo CI on this Draft — expected to pass everywhere it passes on master.

Note to CLI-team reviewer

Because this SDK ships to customers, a bad bump breaks their CI. This PR is a pure lockfile refresh, no API surface change, but please confirm before undrafting that a representative browserstack.yml parses identically on the branch.

Note

Source PR #1183 remains open pending confirmation this consolidated one is preferred for merge — will close once this lands.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: fa372708-da79-4e90-918b-cc41f3a05867

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Ravneet2003]

Deep-dive review — no status posted, per request.

The two CVE targets landed correctly: js-yaml 3.14.2→3.15.2 & 4.1.1→4.3.2 (GHSA-52cp-r559-cp3m), brace-expansion 1.1.14→1.1.18 & 2.1.0→2.1.4 (GHSA-3jxr-9vmj-r5cp). ✅

[Medium] Scope is wider than the description. The PR says "Bump vulnerable transitives via npm audit fix … js-yaml + brace-expansion", but the lockfile actually bumps 27 packages, including two that aren't transitive-only:

• axios 1.16.1 → 1.20.0 — a direct dep (^1.15.0), a minor bump, not a patch. axios is the HTTP client the CLI uses against BrowserStack APIs.
• form-data 4.0.5 → 4.0.6 (direct, ^4.0.0).
• plus the whole @babel/* toolchain (16 pkgs), browserslist data, ws, qs, semver, glob, etc.

npm audit fix cascades npm update across the tree, so this is expected behaviour — but for a security PR that emphasises a minimal, independently-reviewable/rollback-able diff, dragging a minor axios bump into a 'two-CVE' change is worth either (a) documenting the full set + confirming the CLI test suite passes against axios 1.20.0, or (b) using targeted overrides for just js-yaml + brace-expansion to keep the fix surgical. CodeQL/Semgrep/Analyze are green, which helps, but they won't catch an axios behavioural change.

[jasbir-browserstack]

Addressed the [Medium] scope-cascade finding in b7472d5.

Approach: switched from npm audit fix cascade to targeted npm overrides. Reset package-lock.json to master's baseline, then added per-major overrides in package.json:

"js-yaml@3": "3.15.2",
"js-yaml@4": "4.3.2",
"brace-expansion@1": "1.1.18",
"brace-expansion@2": "2.1.4"

Verified via npm install --package-lock-only:

Package	Master	After PR
js-yaml (root)	4.1.1	4.3.2
js-yaml (nested @istanbuljs)	3.14.2	3.15.2
brace-expansion (root)	1.1.14	1.1.18
brace-expansion (nested mocha/readdir-glob)	2.1.0	2.1.4
axios	1.16.1	1.16.1 (unchanged)
form-data	4.0.5	4.0.5 (unchanged)

• package-lock.json diff shrunk from +131/-131 (27 packages) to +21/-21 (4 packages).
• Both target CVEs absent from npm audit.
• @babel/*, browserslist, ws, qs, semver, glob — all untouched. No direct-dep bump, no cascade.

The trade-off you noted (surgical vs cascade) is now surgical. Please re-review when you get a chance.