fix(deps): bump certifi to 2026.10.19 for eMudhra CA distrust

package.json

@@ -16,9 +16,9 @@
     "@stoplight/prism-http": "5.16.0",
     "@stoplight/prism-http-server": "5.16.0",
     "@tootallnate/once": "2.0.1",
-    "fast-uri": "4.1.4",
+    "fast-uri": "4.1.5",
     "fast-xml-parser": "5.8.0",
-    "js-yaml": "5.2.3",
+    "js-yaml": "5.4.1",
     "lodash": "4.18.1",
     "qs": "6.16.0",
     "uuid": "11.1.1",

scripts/audit-js-tooling.mjs

@@ -29,6 +29,18 @@ const ALLOWED = {
       "--dynamic flag, so no Postman collection is parsed and faker generates " +
       "nothing. Prism is a devDependency and is never part of the published wheel.",
   },
+  "GHSA-vfj7-8cjw-p6xm": {
+    package: "braces",
+    expires: "2026-12-31",
+    reason:
+      "Stack-exhaustion DoS when braces expands a deeply nested caller-supplied " +
+      "pattern. No patched release exists (all versions <= 3.0.3 affected). " +
+      "Reaches us only as chokidar 3.6.0 under @stoplight/prism-cli, which " +
+      "watches the single spec path we pass to `prism mock` with " +
+      "disableGlobbing: true (prism-cli dist/util/runner.js), so no pattern is " +
+      "ever expanded. Prism is a devDependency and is never part of the " +
+      "published wheel. Re-review when braces ships a fix.",
+  },
 };
 
 function auditReport() {