fix: Bump brace-expansion from 1.1.13 to 1.1.21

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #3441

Approach

Bumps the transitive dependency brace-expansion on all three version lines present in the lock file (lock file only):

Version line	From	To	Lock file copies	Parent
1.x	1.1.13	1.1.21	node_modules/brace-expansion (dev)	minimatch@3.1.2 (^1.1.7)
2.x	2.0.3	2.1.7	minimatch, js-beautify (production); @jest/reporters, eslint-plugin-jest, jest-config, jest-runtime (dev)	minimatch@9.x (^2.0.1)
5.x	5.0.5	5.0.12	@typescript-eslint/typescript-estree (dev)	minimatch@10.2.5 (^5.0.5)

The 2.x copies are production dependencies via js-beautify → editorconfig → minimatch@9.0.1 and js-beautify → glob → minimatch@9.0.5. All new versions are within the ranges already declared by the parent packages. The copies bundled inside the npm package (npm → brace-expansion@2.0.2, @semantic-release/npm → npm → brace-expansion@5.0.4) are bundled dependencies and are not changed.

This resolves the open high-severity Dependabot alerts for brace-expansion:

• GHSA-3jxr-9vmj-r5cp: DoS via exponential-time expansion of consecutive non-expanding {} groups (patched in 1.1.16, 2.1.2, 5.0.7)
• GHSA-mh99-v99m-4gvg: DoS via unbounded expansion length causing an out-of-memory crash (patched in 1.1.17, 2.1.3, 5.0.8)
• GHSA-rgw5-rvv9-x895: DoS via unbounded intermediate arrays (patched in 1.1.18, 2.1.4, 5.0.9)

Changes

1.x line (1.1.13 → 1.1.21)

• 1.1.14: Added an optional { max } option to cap the number of expansions (opt-in, default unbounded)
• 1.1.15: Numeric ranges now respect max (backport of 5.0.6, GHSA-jxxr-4gwj-5jf2)
• 1.1.16: Security fix for GHSA-3jxr-9vmj-r5cp
• 1.1.17: Security fix for GHSA-mh99-v99m-4gvg; expansions are now capped by default (max 100,000 results, maxLength 4,000,000 characters)
• 1.1.18: Security fix for GHSA-rgw5-rvv9-x895
• 1.1.19: DoS hardening: comma groups are parsed iteratively so long chains no longer overflow the stack
• 1.1.20: DoS hardening: nesting depth is capped (maxDepth, default 1,000)
• 1.1.21: DoS hardening: the {a},b} rescan is capped (maxRewrites, default 1,000)

2.x line (2.0.3 → 2.1.7)

• 2.1.0: Added an optional { max } option to cap the number of expansions (opt-in, default unbounded). This is the minor-version change; the API change is additive (optional second argument)
• 2.1.1: Numeric ranges now respect max (backport of 5.0.6, GHSA-jxxr-4gwj-5jf2)
• 2.1.2: Security fix for GHSA-3jxr-9vmj-r5cp
• 2.1.3: Security fix for GHSA-mh99-v99m-4gvg; expansions are now capped by default (max 100,000 results, maxLength 4,000,000 characters)
• 2.1.4: Security fix for GHSA-rgw5-rvv9-x895
• 2.1.5: DoS hardening: comma groups are parsed iteratively so long chains no longer overflow the stack
• 2.1.6: DoS hardening: nesting depth is capped (maxDepth, default 1,000)
• 2.1.7: DoS hardening: the {a},b} rescan is capped (maxRewrites, default 1,000)

5.x line (5.0.5 → 5.0.12)

• 5.0.6: Security fix for GHSA-jxxr-4gwj-5jf2: numeric ranges now respect max
• 5.0.7: Security fix for GHSA-3jxr-9vmj-r5cp
• 5.0.8: Security fix for GHSA-mh99-v99m-4gvg (new maxLength option, default 4,000,000 characters); dropped Node 18 from engines (now 20 || >=22, which is compatible with this repository's engines.node and CI matrix)
• 5.0.9: Security fix for GHSA-rgw5-rvv9-x895
• 5.0.10: DoS hardening: comma groups are parsed iteratively so long chains no longer overflow the stack
• 5.0.11: DoS hardening: nesting depth is capped (maxDepth, default 1,000)
• 5.0.12: DoS hardening: the {a},b} rescan is capped (maxRewrites, default 1,000)

Breaking Changes

None

Code Changes Required

None. The upgrade is a drop-in replacement. The export shape is unchanged: 1.x and 2.x still export the expand function as module.exports, and 5.x still has the named expand export. The only API change is a new optional options argument. The parent packages call expand(pattern) (minimatch@3.1.2 and minimatch@9.x) or expand(pattern, { max }) (minimatch@10.2.5), and both still work. The new default limits only affect pathological patterns (more than 100,000 results, 4,000,000 characters, or 1,000 nesting levels), far beyond any realistic glob pattern.

Tasks

None. This PR changes the lock file only.

Summary by CodeRabbit

• Chores
  • Updated underlying project components to newer versions. These maintenance changes do not add or alter user-facing features, and no changes to the app’s visible behavior are noted. There are no new controls, workflows, or capabilities for users in this release.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: d38c436d-00ec-4f3b-8fa1-60d59e2291e7

📥 Commits

Reviewing files that changed from the base of the PR and between bb0f9e0 and 6010d9b.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: Your plan provides up to 8 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The lockfile updates root and nested brace-expansion versions, registry URLs, and integrity hashes. The @typescript-eslint/typescript-estree nested entry also changes its Node.js engine range.

Changes

Dependency lockfile updates

Layer / File(s)	Summary
Update brace-expansion lock entries package-lock.json	The root entry moves from version 1.1.13 to 1.1.21. Nested entries move to updated versions. Registry URLs and integrity hashes change, and the @typescript-eslint/typescript-estree entry has a changed Node.js engine range.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Merge Risk: ⚪ Minimal · up to 6010d

The updated lockfile versions fit their dependency ranges, and the engine change remains compatible with supported runtimes. No actionable merge risk remains.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Engage In Review Feedback	❓ Inconclusive	The supplied review metadata reports zero actionable findings for the current review. It explicitly does not establish whether earlier posted feedback comments exist or whether those comments were dis…	Provide the complete review-feedback history and discussion states. For every prior feedback comment, show either a commit that implements it or documented reviewer engagement that caused the reviewer to retract or accept the concern.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the required fix: prefix and clearly describes the dependency update.
Description check	✅ Passed	The description includes all required sections and provides detailed issue, approach, dependency, security, compatibility, and task information.
Linked Issues check	✅ Passed	Issue #3441 requires brace-expansion 1.x to move from 1.1.13 to 1.1.21. The reviewed change updates the root package-lock.json entry to 1.1.21 and updates its registry URL and integrity hash. The …
Out of Scope Changes check	✅ Passed	The additional brace-expansion updates from 2.0.3 to 2.1.7 and from 5.0.5 to 5.0.12 remain lock-file updates for the same dependency. The PR summary connects these versions to the same denial-of-ser…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check	✅ Passed	PASS. The PR changes only package-lock.json and introduces no executable code or new security-sensitive pattern. All changed brace-expansion records move to 1.1.21, 2.1.7, or 5.0.12, which are at or a…

Full details: Engage In Review Feedback

Explanation

The supplied review metadata reports zero actionable findings for the current review. It explicitly does not establish whether earlier posted feedback comments exist or whether those comments were discussed, implemented, or retracted. The repository contains no review-discussion record that can resolve this gap.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[parseplatformorg]

🎉 This change has been released in version 9.3.0-alpha.6