feat: update to avoid brace-extansion issue

[MaitreGEEK]

@sentry/node › @fastify/otel › minimatch › brace-expansion
moderate: brace-expansion: Zero-step sequence causes process hang and memory exhaustion - GHSA-f886-m6hf-6m8v

Before submitting a pull request, please take a look at our
Contributing guidelines and verify:

• [x ] If you've added code that should be tested, please add tests.
• [ x] Ensure your code lints and the test suite passes (yarn lint) & (yarn test).
• [x ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.

Closes #20204 #20204

[sdk-maintainer-bot]

This PR has been automatically closed. The referenced issue does not show a discussion between you and a maintainer.

To avoid wasted effort on both sides, please discuss your proposed approach in the issue first and wait for a maintainer to respond before opening a PR.

Please review our contributing guidelines for more details.

[github-actions]

Semver Impact of This PR

🟡 Minor (new features)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

New Features ✨

• Update to avoid brace-extansion issue by MaitreGEEK in #20205

---

_{🤖 This preview updates automatically when you update the PR.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 53ef9de. Configure here.}

[cursor]

yarn.lock not updated for dependency version bump

High Severity

The package.json bumps @fastify/otel to 0.18.1 (exact pin, no ^/~), but the yarn.lock still resolves @fastify/otel@0.18.0. This inconsistency means yarn install --frozen-lockfile (common in CI) will fail, and the intended security fix for the brace-expansion vulnerability won't actually take effect since the lockfile still pins the old version with the vulnerable transitive dependency. The yarn.lock needs to be regenerated to include the new version.

 

^{Reviewed by Cursor Bugbot for commit 53ef9de. Configure here.}