diff --git a/package-lock.json b/package-lock.json
index 0a9f445..7b7ed06 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -979,9 +979,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.4.tgz",
-      "integrity": "sha512-dODXrIxlS9JSdgAnhIUKOosKV1oMtU2VtVw87QRaHzyl5jxO290Ii5tEZfCfzfWNHi3jKWwBSdQj0qIyshdZdQ==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.5.tgz",
+      "integrity": "sha512-vZeoMRB4epNr7QfdHxel7te/RcX16CxyXI07JCCTFWZA2s4v1azGNESRj+2EoaHSaWFL/Z3GmKT2jF6A202jLg==",
       "dev": true,
       "funding": [
         {
@@ -1409,9 +1409,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz",
-      "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==",
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
+      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index a389572..df2ada9 100644
--- a/package.json
+++ b/package.json
@@ -16,9 +16,9 @@
     "@stoplight/prism-http": "5.16.0",
     "@stoplight/prism-http-server": "5.16.0",
     "@tootallnate/once": "2.0.1",
-    "fast-uri": "4.1.4",
+    "fast-uri": "4.1.5",
     "fast-xml-parser": "5.8.0",
-    "js-yaml": "5.2.3",
+    "js-yaml": "5.4.1",
     "lodash": "4.18.1",
     "qs": "6.16.0",
     "uuid": "11.1.1",
diff --git a/scripts/audit-js-tooling.mjs b/scripts/audit-js-tooling.mjs
index e997187..2882b77 100755
--- a/scripts/audit-js-tooling.mjs
+++ b/scripts/audit-js-tooling.mjs
@@ -29,6 +29,18 @@ const ALLOWED = {
       "--dynamic flag, so no Postman collection is parsed and faker generates " +
       "nothing. Prism is a devDependency and is never part of the published wheel.",
   },
+  "GHSA-vfj7-8cjw-p6xm": {
+    package: "braces",
+    expires: "2026-12-31",
+    reason:
+      "Stack-exhaustion DoS when braces expands a deeply nested caller-supplied " +
+      "pattern. No patched release exists (all versions <= 3.0.3 affected). " +
+      "Reaches us only as chokidar 3.6.0 under @stoplight/prism-cli, which " +
+      "watches the single spec path we pass to `prism mock` with " +
+      "disableGlobbing: true (prism-cli dist/util/runner.js), so no pattern is " +
+      "ever expanded. Prism is a devDependency and is never part of the " +
+      "published wheel. Re-review when braces ships a fix.",
+  },
 };
 
 function auditReport() {
diff --git a/uv.lock b/uv.lock
index 7be46b1..bdd1c52 100644
--- a/uv.lock
+++ b/uv.lock
@@ -74,11 +74,11 @@ dev = [
 
 [[package]]
 name = "certifi"
-version = "2026.2.25"
+version = "2026.10.19"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/af/2d/7bf41579a8986e348fa033a31cdd0e4121114f6bce2457e8876010b092dd/certifi-2026.2.25.tar.gz", hash = "sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7", size = 155029, upload-time = "2026-02-25T02:54:17.342Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9a/3c/c17fb3ca2d9c3acff52e30b309f538586f9f5b9c9cf454f3845fc9af4881/certifi-2026.2.25-py3-none-any.whl", hash = "sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa", size = 153684, upload-time = "2026-02-25T02:54:15.766Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
 ]
 
 [[package]]