fix(deps): brace-expansion 5.0.8 on top of #50 (5.0.7 is still vulnerable)

[yakimoto]

Builds on #50 and takes brace-expansion one version further, to the one that actually clears the advisory.

brace-expansion  5.0.7 → 5.0.8      (on top of #50's eslint upgrade)

Four lines on top of #50. Merge this instead of #50 — it contains #50 in full.

#50 does the hard part, then stops one version short

brace-expansion has two live advisories. #50 targets the older >= 3.0.0, < 5.0.7 (fix 5.0.7). The newer — GHSA-mh99-v99m-4gvg, range <= 5.0.7, patched in 5.0.8 — puts 5.0.7 inside the vulnerable range. So #50 lands on a version that is still flagged.

Measured, dev scope included, on all three states:

	brace-expansion	total	high	remaining
main @ eb79119	1.1.15	3	2	brace-expansion, esbuild, js-yaml
#50 as-is	5.0.7	2	1	brace-expansion still flagged, esbuild
this PR	5.0.8	1	0	esbuild (low, dev-only)

Why #50's approach is the right one, and worth saying out loud

I expected this repo to be unfixable. It was the worst case in the fleet survey (wave-av/claude-workstation#562): main carries two trees at once —

node_modules/minimatch                                          -> 3.1.5
node_modules/brace-expansion                                    -> 1.1.15
node_modules/@typescript-eslint/typescript-estree/…/minimatch   -> 10.2.5
node_modules/@typescript-eslint/typescript-estree/…/brace-expansion -> 5.0.6

minimatch@3.1.5 does const expand = require('brace-expansion') and calls the result as a function, while every patched brace-expansion exports an object. Forcing a patched version onto that tree produces TypeError: expand is not a function at runtime while npm audit reports clean — claude-workstation#554, where it also passed 195/195 tests. And the root tree's own alert (< 1.1.16) is a trap inside the trap: 1.1.16 is API-compatible, but it was published 2026-07-08, before the fix landed on 2026-07-23, and the v1 line never got the backport. API-compatible is not the same as patched.

The conclusion I'd drawn from that was "dismiss it, no safe fix exists." That was wrong, and #50 is why. Rather than overriding brace-expansion under a consumer that can't take it, #50 upgrades the consumer: bumping eslint moves @eslint/config-array from minimatch: ^3.1.5 to ^10.2.4 and drops @eslint/eslintrc entirely — the two things that were pinning minimatch@3. The result is a single hoisted tree with no minimatch@3 anywhere:

$ git show refs/pull/50/head:package-lock.json | …
node_modules/brace-expansion -> 5.0.7
node_modules/minimatch       -> 10.2.5
any minimatch@3? False

Once minimatch@3 is gone, 5.0.8 is simply safe — minimatch@10 uses named exports and expects the object shape. The general rule, the one worth keeping: when a transitive dependency can't be patched, upgrade the parent that pins it rather than overriding the child.

It also incidentally clears the js-yaml HIGH (alert #5), because @eslint/eslintrc was what pulled js-yaml@4.2.0 in. That makes #53 redundant — see my comment there.

Verification

CI can't run — Actions are refusing every job org-wide on an account-level billing lock (plan=free, locked=yes, re-confirmed live today). All local, Node 22.14.0:

npm run lint        → clean (--max-warnings 0)
npm run type-check  → clean
npm run build       → ESM 31.72 KB + CJS 34.04 KB, success

npm run lint is the one that matters here, not a formality: eslint is the actual consumer of minimatch/brace-expansion, and #50 upgrades eslint itself. A clean --max-warnings 0 run over src/ exercises the changed dependency end-to-end.

This repo has no test suite, so I also drove the module directly — npm audit only compares version strings and never loads anything:

minimatch 10.2.5 | brace-expansion 5.0.8
match  : true      # minimatch('file2.js','file{1,2}.js')
control: false     # minimatch('file3.js','file{1,2}.js')
nested : true      # minimatch('a/b/c.ts','a/{b,d}/{c,e}.ts')
be export: object EXPANSION_MAX,EXPANSION_MAX_LENGTH,expand

That last line is precisely the shape that breaks minimatch@3 — and brace expansion resolves correctly through minimatch@10.

Measurement caveat: this workstation exports NODE_ENV=production, which makes npm audit inherit omit=dev and hide dev-scope entries entirely — which is all of these. Every figure above was taken with NODE_ENV=development set explicitly.

Unrelated thing I noticed

This repo has no .gitignore, so node_modules/ shows up as untracked rather than ignored. On a public repo that's one git add -A away from a very bad commit. Not fixing it in this PR; flagging it as worth its own.

---

Note

^{Cursor Bugbot is generating a summary for commit b1d1b0f. Configure here.}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

---

Summary by cubic

Upgrades the linting stack to clear the remaining brace-expansion advisory by moving to eslint ^10.7.0 and resolving brace-expansion to 5.0.8. This hoists minimatch@10 and removes legacy deps.

• Dependencies

  • Update eslint to ^10.7.0 (hoists minimatch@10, removes @eslint/eslintrc).
  • Transitive: brace-expansion to 5.0.8 (fixes GHSA-mh99-v99m-4gvg) with balanced-match ^4; drops js-yaml, chalk/supports-color, and other old internals.

• Migration

  • Development requires Node 20.19+ for eslint tooling.

^{Written for commit ba923b1. Summary will update on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: ba923b1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a63ec7c5-d234-4f37-a039-c11cb5279763)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint@​9.39.4 ⏵ 10.7.0	+1

View full report

[coderabbitai]

📝 Walkthrough

Walkthrough

The ESLint development dependency in package.json is updated from ^9.39.4 to ^10.7.0.

Changes

ESLint Version Update

Layer / File(s)	Summary
Update ESLint development dependency package.json	Changes the declared ESLint development dependency from ^9.39.4 to ^10.7.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title matches the PR's main change: bumping brace-expansion to 5.0.8 to address the remaining vulnerability.
Description check	✅ Passed	The description clearly explains what changed and why, but it does not follow the template headings or include the checklist section.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/brace-expansion-5-0-8-on-eslint-bump

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/brace-expansion-5-0-8-on-eslint-bump

Warning

Review ran into problems

🔥 Problems

These MCP integrations need to be re-authenticated in the Integrations settings: Sentry

---

_{Comment @coderabbitai help to get the list of available commands.}