fix(deps): execute npm audit fix (brace-expansion)

[MikeMcC399]

Situation

npm audit reports multiple vulnerabilities in the root of the repo for the transient dependency brace-expansion

$ npm ci

> @cypress/github-action@0.0.0-development prepare
> husky


added 253 packages, and audited 254 packages in 2s

71 packages are looking for funding
  run `npm fund` for details

1 high severity vulnerability

To address all issues, run:
  npm audit fix

Run `npm audit` for details.
mike@ubuntu-26:~/github/CYPRESS-IO/github-action$ npm audit
# npm audit report

brace-expansion  <=1.1.20 || 4.0.0 - 5.0.11
Severity: high
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service - https://github.com/advisories/GHSA-q2hr-2g5m-vwhr
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service - https://github.com/advisories/GHSA-q2hr-2g5m-vwhr
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion - https://github.com/advisories/GHSA-qhr7-859c-m2p7
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion - https://github.com/advisories/GHSA-qhr7-859c-m2p7
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion - https://github.com/advisories/GHSA-6j4f-fj2g-mc7p
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion - https://github.com/advisories/GHSA-6j4f-fj2g-mc7p
fix available via `npm audit fix`
node_modules/@eslint/config-array/node_modules/brace-expansion
node_modules/brace-expansion
node_modules/eslint/node_modules/brace-expansion

1 high severity vulnerability

To address all issues, run:
  npm audit fix

Change

The vulnerabilities will not be fixed by Renovate or by attempting to update direct dependencies.

Execute npm audit fix and rebuild action.

---

Note

Low Risk
Dependency-only security hardening for glob/brace parsing; legitimate patterns should behave the same, with pathological input truncated instead of crashing or hanging.

Overview
Addresses high-severity brace-expansion advisories (stack exhaustion and quadratic CPU use on malicious patterns) by running npm audit fix, which bumps brace-expansion in the lockfile (e.g. 1.1.18 → 1.1.21, nested 5.0.9 → 5.0.12 under ESLint).

The rebuilt dist/index.js carries the patched expansion logic: new caps EXPANSION_MAX_DEPTH and EXPANSION_MAX_REWRITES, optional maxDepth / maxRewrites on expandTop, depth checks in expand, a bounded {a},b} rewrite loop, parseCommaParts rewritten iteratively (no recursive tail on chained brace groups), and pushAll instead of spread/apply pushes to avoid stack blowups.

^{Reviewed by Cursor Bugbot for commit 67fbd8b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🎉 This PR is included in version 7.4.6 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀