fix: remediate brace-expansion vulnerability
What changed
Remediated all brace-expansion findings via safe npm overrides and lockfile updates in package.json and package-lock.json.
Validation
Repository setting: Agent decides. The agent chooses relevant checks. Observed results are reported below.
Passed npm ci, 44 tests, lint, lockfile verification, and diff checks. Resolved versions are 1.1.21, 2.1.7, and 5.0.12; audit reports no brace-expansion issues. One unrelated pre-existing js-yaml advisory remains. Validation used Node 24.18.1/npm 11.16.0; Node 20 was unavailable.
Repository CI: Not yet verified by Mendr. Check this PR’s status checks before merging.
Security context
Remediate the reported vulnerabilities in brace-expansion.
Reported advisories: GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895, CVE-2026-13149, CVE-2026-14257, CVE-2026-69152
Affected dependency files:
package-lock.json
Independent AI review
The repair is acceptable: all brace-expansion lockfile entries are upgraded to fixed versions, with compatible overrides. npm ci, 44 tests, lint, exact-version checks, and diff validation passed. The remaining audit result is the accurately reported pre-existing js-yaml issue.
Execution details
| Recorded results | Exit 0 | Nonzero or unconfirmed |
|---|---|---|
| 43 | 37 | 6 |
These counts include investigation, setup, checks, and cleanup. They are not a test pass rate. Full command output is retained in the Mendr repair record.
Base: f472c2f
Reviewed commit: 694ee18
Repair run: b1be3540-4bb1-4e1e-a3c5-f91ea1ea209d