fix(deps): update brace-expansion past GHSA-rgw5-rvv9-x895 - #13

Summary

• update the brace-expansion override from 5.0.8 to 5.0.9
• regenerate the lockfile with the patched release
• document GHSA-rgw5-rvv9-x895 in the changelog

Commits

• 37767e8 fix(deps): update brace-expansion override
• 665bb48 docs(changelog): note brace-expansion advisory

Verification

• docker run ... node:20.19.0 ... npm ci
• docker run ... node:22 ... npm ci
• docker run ... node:24 ... npm ci
• docker run ... node:20.19.0 ... npm ci && npm run release:check
  • npm audit: 0 vulnerabilities
  • npm audit --omit=dev: 0 vulnerabilities
  • typecheck and lint passed
  • 72 tests passed
  • smoke and package smoke passed
• git diff --check origin/main..HEAD