refactor: Bump brace-expansion from 1.1.13 to 1.1.18

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license of this repository.

Issue

Closes #274

Dependabot security update for the transitive dependency brace-expansion. This PR replaces the Dependabot PR because bot branches cannot be modified directly, so the change is reproduced here on a branch that can be reviewed and adjusted.

Approach

Bumps the transitive dependency brace-expansion to pick up the fix for GHSA-3jxr-9vmj-r5cp / CVE-2026-13149: a denial of service caused by exponential-time (O(2^n)) expansion of consecutive non-expanding {} groups in expand(). A short crafted input can block the event loop for minutes. The advisory is patched in 1.1.16 on the 1.x line and in 5.0.7 on the 5.x line.

brace-expansion is not listed in package.json; it is pulled in transitively through minimatch. Therefore only package-lock.json changes — package.json is untouched and lockfileVersion: 3 is preserved.

The bump was applied with npm update brace-expansion --ignore-scripts, which resolves each instance to the newest version permitted by its parent's semver range:

Lockfile entry	Path	Before	After
node_modules/glob/node_modules/brace-expansion	@babel/cli › glob › minimatch	1.1.13	1.1.18
node_modules/brace-expansion	eslint › minimatch	5.0.5	5.0.9

Notes on the resolved versions:

• Dependabot targeted 1.1.16, but ^1.1.7 resolves to 1.1.18, the current 1.x release. It contains the same advisory fix, so the result is ahead of the bot's target rather than behind it. The lockfile was not hand-edited to force an exact 1.1.16 pin.
• The top-level 5.0.5 entry was also affected by the same advisory (patched from 5.0.7), so it is bumped to 5.0.9 in the same pass.
• The copy bundled inside npm (via @semantic-release/npm) resolves to 5.0.7, which is already patched and is not modifiable from this repository's lockfile.

Engine compatibility: brace-expansion@5.0.9 declares engines.node: "20 || >=22". This repository requires "20 || 22 || 24" and CI runs Node 20.19.5, 22.21.1 and 24.11.1, so all supported versions remain satisfied.

Verification: npm ci --ignore-scripts completes successfully and npm ls brace-expansion --all resolves the tree without conflicts or peer dependency breakage. No vulnerable brace-expansion version remains in the dependency tree.

Tasks

• Verified the dependency tree installs and resolves cleanly (npm ci --ignore-scripts, npm ls brace-expansion --all)

Tests and documentation changes do not apply: this is a lockfile-only bump of a transitive development dependency with no source, API or behavior changes.

Summary by CodeRabbit

• Chores
  • Updated dependency metadata to newer compatible versions.
  • Refreshed package integrity information and runtime compatibility requirements.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6c788664-d9d0-4c69-9daa-9075ef81621e

📥 Commits

Reviewing files that changed from the base of the PR and between 0835646 and 7117d39.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The pull request updates brace-expansion entries in package-lock.json. The direct dependency changes from 5.0.5 to 5.0.9. The nested dependency changes from 1.1.13 to 1.1.18.

Changes

Dependency refresh

Layer / File(s)	Summary
Update brace-expansion lock entries package-lock.json	The lockfile updates the direct and nested brace-expansion versions, resolved URLs, integrity hashes, and the direct package’s Node engine constraint.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 7117d

This dependency-only update preserves supported Node.js versions and introduces no actionable merge-blocking risk; it is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the required refactor: prefix and clearly describes the dependency update. The first letter after the prefix is capitalized.
Description check	✅ Passed	The description includes the required sections and provides clear issue linkage, implementation details, security rationale, compatibility information, and verification results.
Linked Issues check	✅ Passed	The changes satisfy issue #274 by updating brace-expansion from 1.1.13 to 1.1.18, which includes the requested security fix in 1.1.16 and remains within the existing dependency range. The rela…
Out of Scope Changes check	✅ Passed	All changes are limited to package-lock.json dependency metadata and address the same security vulnerability described in issue #274. No unrelated source, API, documentation, or configuration change…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check	✅ Passed	PASS. The pull request changes only package-lock.json dependency metadata. It replaces brace-expansion 5.0.5 with 5.0.9 and 1.1.13 with 1.1.18, with matching registry URLs and SHA-512 integrity va…
Engage In Review Feedback	✅ Passed	PASS: No substantive review feedback was present for this pull request. The exact PR (#276) has zero inline review comments and no submitted reviews. Its issue comments contain only automated acknowle…

Full details: Linked Issues check

Explanation

The changes satisfy issue #274 by updating brace-expansion from 1.1.13 to 1.1.18, which includes the requested security fix in 1.1.16 and remains within the existing dependency range. The related 5.0.5 instance is also updated to patched version 5.0.9.

Full details: Out of Scope Changes check

Explanation

All changes are limited to package-lock.json dependency metadata and address the same security vulnerability described in issue #274. No unrelated source, API, documentation, or configuration changes are present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Security Check

Explanation

PASS. The pull request changes only package-lock.json dependency metadata. It replaces brace-expansion 5.0.5 with 5.0.9 and 1.1.13 with 1.1.18, with matching registry URLs and SHA-512 integrity values. No source code or executable security pattern changed. The new 5.x engine range remains compatible with the project engine range (20 || 22 || 24). The remaining bundled npm copy (5.0.7) is unchanged by this pull request.

Full details: Engage In Review Feedback

Explanation

PASS: No substantive review feedback was present for this pull request. The exact PR (#276) has zero inline review comments and no submitted reviews. Its issue comments contain only automated acknowledgements, Codecov output, and a request to trigger the CodeRabbit review; no feedback was ignored or resolved. The commit changes only package-lock.json.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (0835646) to head (7117d39).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #276   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            4         4           
  Lines          159       159           
=========================================
  Hits           159       159           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mtrezza]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.