chore(deps): bump the npm_and_yarn group across 2 directories with 5 updates

[dependabot]

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
js-yaml	4.2.0	4.3.0
brace-expansion	1.1.15	1.1.16
engine.io	6.6.6	6.6.9
protobufjs	7.6.4	7.6.5
tar	7.5.16	7.5.20

Bumps the npm_and_yarn group with 3 updates in the /samples/community directory: brace-expansion, protobufjs and tar.

Updates js-yaml from 4.2.0 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
• Added formal data layers (events and AST) for modular data pipelines.
  • Added low-level parser (to events), presenter and visitor APIs.
• Added the YAML Test Suite to the test set.

Changed

• See the migration guide for upgrade notes.
• Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• See full diff in compare view

Updates brace-expansion from 1.1.15 to 1.1.16

Commits

• 447763a 1.1.16
• d74e630 fix: v1 backport for CVE-2026-13149 (#122)
• See full diff in compare view

Updates engine.io from 6.6.6 to 6.6.9

Commits

• 9dbec81 chore(release): engine.io@6.6.9
• 3ad4e1f docs: improve example with PM2
• 0e5afee docs: add example with PM2
• eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
• c17890c docs: add documentation about WebTransport
• 20df6ae docs(examples): add client-side load balancing example
• 16d1923 ci(publish): enable staged publishing
• ad48a9b docs(examples): add example with HTTP/2
• 190572d refactor(eio-client): remove XMLHttpRequest from the definition file
• fad463c docs(examples): fix duplicate self messages (#5341)
• Additional commits viewable in compare view

Updates protobufjs from 7.6.4 to 7.6.5

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.6.5

7.6.5 (2026-07-04)

Bug Fixes

• handle EOF during options parsing (#2352) (#2356) (10fba6d)

Changelog

Sourced from protobufjs's changelog.

7.6.5 (2026-07-04)

Bug Fixes

• handle EOF during options parsing (#2352) (#2356) (10fba6d)

Commits

• 89048ba chore: release protobufjs-v7.x (#2357)
• 10fba6d fix: handle EOF during options parsing (#2352) (#2356)
• See full diff in compare view

Updates tar from 7.5.16 to 7.5.20

Commits

• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• 7a635c2 terminate pax strings on nul bytes
• See full diff in compare view

Updates brace-expansion from 1.1.15 to 1.1.16

Commits

• 447763a 1.1.16
• d74e630 fix: v1 backport for CVE-2026-13149 (#122)
• See full diff in compare view

Updates protobufjs from 7.6.4 to 7.6.5

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.6.5

7.6.5 (2026-07-04)

Bug Fixes

• handle EOF during options parsing (#2352) (#2356) (10fba6d)

Changelog

Sourced from protobufjs's changelog.

7.6.5 (2026-07-04)

Bug Fixes

• handle EOF during options parsing (#2352) (#2356) (10fba6d)

Commits

• 89048ba chore: release protobufjs-v7.x (#2357)
• 10fba6d fix: handle EOF during options parsing (#2352) (#2356)
• See full diff in compare view

Updates tar from 7.5.16 to 7.5.20

Commits

• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• 7a635c2 terminate pax strings on nul bytes
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[ditman]

If CI is happy, I'm happy. This looks like minor bumps.

[ditman]

Temporarily closing this until we figure out if this is needed in the basic catalog or can be in OP's code.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

[ditman]

Closed the wrong PR, let's land this!

[ditman]

/dependabot try again :P