fix(deps): remediate available high-severity vulnerabilities

[pjb157]

Summary

• resolve brace-expansion to 1.1.16 and 5.0.7
• resolve js-yaml to 4.3.0
• resolve quinn-proto to 0.11.15 in both Cargo lockfiles
• upgrade react-router and react-router-dom to 7.18.1
• resolve postcss to 8.5.18
• covers Dependabot alerts chore(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 in /dashboard #144–fix: query key ordering #146, feat: caching configuration for static files #149, opt: optimize frontend by self-hosting fonts, and preloading images #152, chore: default batches to on #153, and frontend optimization: bundle splitting #156

Unresolved dependency

Dependabot alert #154 remains open. GitHub reports react-router 8.3.0 as the first patched version, but npm currently has no react-router or react-router-dom 8.3.0 release; 7.18.1 is the latest available version. This alert cannot be fully remediated until the patched package is published or GitHub corrects the advisory metadata.

Validation

• pnpm why confirms all listed npm versions
• both Cargo lockfiles contain quinn-proto 0.11.15
• pnpm lint
• pnpm test --run (665 passed)
• pnpm build
• cargo check --workspace --locked

[cloudflare-workers-and-pages]

Deploying control-layer with    Cloudflare Pages

Latest commit:	af4e356
Status:	✅  Deploy successful!
Preview URL:	https://1110d30d.control-layer.pages.dev
Branch Preview URL:	https://agent-fix-critical-high-depe.control-layer.pages.dev

View logs