Override brace-expansion to patched versions to resolve DoS advisory

[fastjames]

Resolves the brace-expansion advisories (GHSA-f886-m6hf-6m8v zero-step-sequence DoS, GHSA-jxxr-4gwj-5jf2 numeric-range max bypass).

Problem

Three transitive copies of brace-expansion, in three different major ranges, were vulnerable:

eslint       -> minimatch@10 -> brace-expansion@5.0.5
jest-circus  -> ...          -> minimatch@9  -> brace-expansion@2.0.2
ts-jest      -> ...          -> minimatch@3  -> brace-expansion@1.1.12

Fix

Because the advisory spans majors 1.x / 2.x / 5.x, a single override can't fix all three without forcing one major onto incompatible minimatch consumers. Instead, version-targeted overrides bump each range to its own patched release:

"overrides": {
  "brace-expansion@1": "^1.1.13",
  "brace-expansion@2": "^2.0.3",
  "brace-expansion@5": "^5.0.6"
}

Result: 1.1.12 -> 1.1.15, 2.0.2 -> 2.1.1, 5.0.5 -> 5.0.6. Lockfile-only beyond the overrides block.

Note: npm audit fix also clears this advisory, but it drags in unrelated @babel/core/browserslist bumps that overlap #89. These targeted overrides keep the change scoped to brace-expansion alone.

Verification (node v24.14.0, per engines: >= 24)

• npm run build (tsc) — passes
• npm test — 37 passed, 4 suites
• npm audit — brace-expansion advisory no longer present

Note

The remaining advisories are tracked separately: @babel/core in #89 and the js-yaml istanbul chain in #90.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a367ea5a-f161-4f8d-a715-aeb7b6ee546a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch deps/brace-expansion-advisory

---

_{Comment @coderabbitai help to get the list of available commands.}

[k1bs]

🍰