Fix brace-expansion DoS advisories (REV-72)

[revopushbot]

Clears Dependabot alerts #62 and #63.

Advisory	Issue	Patched in
GHSA-3jxr-9vmj-r5cp	DoS via exponential-time expansion of consecutive non-expanding {} groups	1.1.16 / 2.1.2
GHSA-mh99-v99m-4gvg (CVE-2026-14257)	DoS via unbounded expansion length causing an OOM crash	5.0.8, backported to 1.1.17 / 2.1.3

Change

Both installed copies were stale relative to their own semver ranges, so npm update brace-expansion was sufficient — lockfile-only, no overrides entry and no manifest change:

Path	Was	Now	Reachability
rimraf@2 → glob@7 → minimatch@3 (also eslint)	1.1.15	1.1.17	production tree
mocha@11 → minimatch@9	2.1.1	2.1.3	dev only

Why not override to 5.0.8

brace-expansion 5.x exports a named expand (exports.expand = expand), while minimatch does const expand = require('brace-expansion'). Forcing 5.x would break glob/rimraf/eslint/mocha at runtime. The maintenance backports are the correct fix.

Verification

Run against the actually-installed copies:

• Normal expansion unchanged — a{b,c}d{1..3} → abd1,abd2,abd3,acd1,acd2,acd3 on both.
• GHSA-3jxr: 40 consecutive empty {} groups expand in 0 ms.
• GHSA-mh99: 6 chained 200 KB groups now cap at 3.6 M chars via the new EXPANSION_MAX_LENGTH = 4_000_000 guard instead of growing unbounded.
• tsc --noEmit clean; eslint and mocha still resolve their globs.

Known false positive after merge

npm audit and Dependabot will keep flagging GHSA-mh99-v99m-4gvg. That advisory currently declares one flat range <= 5.0.7 with first_patched_version: 5.0.8 and has not yet been amended for the 1.1.17 / 2.1.3 backports published 2026-07-28/29. The installed code is patched — confirmed by inspecting both tarballs and exercising the guard above.

Linear: REV-72

🤖 Generated with Claude Code