[DPEDE-1784](deps-dev): Bump brace-expansion from 1.1.12 to 1.1.13

[dependabot]

Bumps brace-expansion from 1.1.12 to 1.1.13.

Commits

• 6c353ca 1.1.13
• 7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[lumen-jenkins-prod]

The CI pipeline did not run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-2003/1/. ❌

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — ✅ Auto-merge eligible

Routine patch bump of a transitive-only dependency with no in-repo usage and no applicable security advisories.

TL;DR

• Merge: ✅ likely safe to merge — patch increment of a transitive dependency; no code impact expected.
• Breaks your code? ✅ Most likely not.
• Security? ✅ no applicable advisories.
• Update: brace-expansion — you have 1.1.12, this PR installs 1.1.13 (patch, spans 1 release). Routine patch refresh; no code impact.

Signal	Value	Interpretation
Bump type	patch	brace-expansion 1.1.12 → 1.1.13; z-level increment — bug fixes only, no API surface changes expected by semver convention.
Dependency risk	low	Patch bump of a transitive-only dependency; confirmed no require/import of brace-expansion anywhere in this repo's source. No breaking changes expected at this semver delta, and none could reach repo code even if present.
Security risk	low	No advisories affect v1.1.13. Four known advisories exist for brace-expansion but all target different version ranges: GHSA-832h-xg76-4gv6 (CVE-2017-18077, CVSS 7.5) affects < 1.1.7 — v1.1.12 already past the fix; GHSA-v6h2-p8h4-qcjw (CVE-2025-5889, CVSS 3.1) affects v2.0.0–2.0.1; GHSA-f886-m6hf-6m8v (CVE-2026-33750, CVSS 6.5) affects v4.0.0–5.0.5; GHSA-jxxr-4gwj-5jf2 (CVE-2026-45149, CVSS 6.5) affects v5.0.0–5.0.6. None apply to the v1.1.x line being installed here.
CI health risk	unknown	CI health check skipped — all fast-path conditions met (patch + no in-repo usage + no applicable CVEs); CI signal is not required to clear this route.
API usage in repo	false	Scanned for all npm import forms (import … from 'brace-expansion', require('brace-expansion'), dynamic import('brace-expansion'), re-export forms); zero hits across all source files — brace-expansion is consumed only transitively and never imported directly.
Cross-repo signal	standalone	No publishable root manifest found in the repo root.
Data completeness	blind	2/5 signals obtained (classification ✅, api_usage ✅); missing: release_notes (changelog unavailable — no web-fetch; assessed from semver delta only), ci_health (fast-path: skipped for patch with no usage and no CVEs), cascade (fast-path: skipped for patch with no usage and no CVEs). Route set by fast-path override.

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

auto_eligible because: all four fast-path conditions are satisfied — patch classification, confirmed zero in-repo usage of brace-expansion, empty advisory_ids (no CVEs affect v1.1.13), and no documented breaking changes in the changelog range.

Escalation category: n/a — not escalated.

Confidence breakdown — score: 0.70. List the factors that produced it, not just the number:

• ✅ Patch-level bump — bug-fix only; no API changes expected by semver convention

• ✅ Confirmed no in-repo usage (brace-expansion is transitive-only, never imported in source)

• ✅ No security advisories affect v1.1.13 — all four known advisories target other major version ranges

• ✅ No cascade conflicts (no competing open Dependabot PRs for the same package)

• ⚠️ Release notes unavailable — changelog was not retrievable; assessed from semver delta + absence of in-repo usage only (−0.10)

• ⚠️ CI health not assessed — fast-path skip applied; actual CI signal not evaluated (−0.20)

• 💡 To reach a lower route: This PR is already at the lowest route (auto_eligible) — no action required.

What AiFEL checked

1. Triage — classified patch (brace-expansion 1.1.12→1.1.13, npm, package-lock.json).
2. Symbol extraction — none found; brace-expansion is not imported in any source file (transitive only).
3. Release-notes comparator — changelog unavailable; patch delta + confirmed zero in-repo usage is sufficient to rule out impact without release notes.
4. CI health — skipped (fast-path: patch + no usage + no CVEs); ci_confidence: unknown.
5. Cascade coordinator — skipped (fast-path); cascade_conflicts set to [].
6. Data completeness — obtained 2/5 signals; missing: release_notes, ci_health, cascade (all fast-path or pre-step gather-failure).

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. brace-expansion is a transitive dependency not imported anywhere in this repo's source, so no application code is reached by this bump regardless of what changes in the patch.

Security advisories

✅ Nothing still affects 1.1.13

Four advisories are on record for brace-expansion, but none apply to the v1.1.x line installed by this PR:

• GHSA-832h-xg76-4gv6 (CVE-2017-18077, CVSS 7.5 high) — ReDoS; affects < 1.1.7, patched in 1.1.7. Both 1.1.12 and 1.1.13 are already past the fix; this bump neither introduces nor resolves it.
• GHSA-v6h2-p8h4-qcjw (CVE-2025-5889, CVSS 3.1 low) — ReDoS; affects >= 2.0.0, <= 2.0.1. Not applicable to v1.1.x.
• GHSA-f886-m6hf-6m8v (CVE-2026-33750, CVSS 6.5 medium) — process hang / memory exhaustion via zero-step sequence; affects >= 4.0.0, < 5.0.5. Not applicable to v1.1.x.
• GHSA-jxxr-4gwj-5jf2 (CVE-2026-45149, CVSS 6.5 medium) — large numeric range defeats max DoS protection; affects >= 5.0.0, < 5.0.6. Not applicable to v1.1.x.

✅ None of the above affect v1.1.13 (advisory_ids: []), and this bump resolves none of them (old version 1.1.12 was already outside all affected ranges for v1.1.x).

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	brace-expansion	1.1.12	1.1.13	Routine patch — no code impact; transitive-only dependency.

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "patch",
  "risk_band": "low",
  "ci_confidence": "unknown",
  "decision_route": "auto_eligible",
  "data_completeness": "blind",
  "escalate_reason": null,
  "missing_signals": [
    {"signal": "release_notes", "reason": "changelog not retrieved by pre-step; agent has no web-fetch — assessed from semver delta and confirmed zero in-repo usage"},
    {"signal": "ci_health", "reason": "fast-path: skipped for patch with no usage and no CVEs"},
    {"signal": "cascade", "reason": "fast-path: skipped for patch with no usage and no CVEs"}
  ],
  "confidence": 0.70,
  "packages": [{"ecosystem": "npm", "name": "brace-expansion", "old_version": "1.1.12", "new_version": "1.1.13"}],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Routine patch bump of transitive-only brace-expansion (1.1.12→1.1.13) with zero in-repo usage and no applicable security advisories; fast-path auto_eligible.",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-2003",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience