[mtrezza]

Closes #298

Security update for a transitive development dependency (lock file only). brace-expansion is not in package.json; both copies are pulled in by minimatch. The upgrade resolves the medium-severity advisory GHSA-q2hr-2g5m-vwhr (CVE-2026-102277), a quadratic-time CPU denial of service in the {a},b} rewrite, which affects brace-expansion < 1.1.21 and >= 4.0.0, < 5.0.12.

Lock file entry	Required by	Before	After
node_modules/brace-expansion	minimatch 10.2.4 (^5.0.2), used by ESLint, Jasmine and nyc (via glob and test-exclude)	5.0.9	5.0.12
node_modules/glob/node_modules/brace-expansion	minimatch 3.1.5 (^1.1.7), used by glob 7.2.3 (via @babel/cli and madge)	1.1.18	1.1.21

The lock file was regenerated with npm update brace-expansion --ignore-scripts. Both target versions are the latest releases of their lines. npm ls brace-expansion --omit=dev is empty, so the package is development-only.

The upgrade also includes the fixes for these advisories, whose alerts were auto-dismissed for the development scope:

• GHSA-6j4f-fj2g-mc7p / CVE-2026-102276 (high), fixed in 1.1.19 and 5.0.10
• GHSA-qhr7-859c-m2p7 / CVE-2026-102278 (high), fixed in 1.1.20 and 5.0.11

The copy of brace-expansion 5.0.9 that is bundled inside the npm package (node_modules/npm/node_modules/brace-expansion, pulled in by @semantic-release/npm) ships with npm's published package and is not changed by this PR. It is updated together with npm itself (npm 11.21.1 bundles 5.0.12), so GitHub may keep the alert for the 5.x line open until then.

Changes

• 1.1.19, 5.0.10: Security fix for GHSA-6j4f-fj2g-mc7p (juliangruber/brace-expansion@0bcbfc0, juliangruber/brace-expansion@6735c94). Comma-separated parts are parsed iteratively, and large arrays are appended without push.apply, so long inputs can no longer exhaust the call stack.
• 1.1.20, 5.0.11: Security fix for GHSA-qhr7-859c-m2p7 (juliangruber/brace-expansion@1efee7c, juliangruber/brace-expansion@935d78f). Adds a maxDepth option that bounds the brace nesting depth (default 1,000); deeper groups are returned literally.
• 1.1.21, 5.0.12: Security fix for GHSA-q2hr-2g5m-vwhr (juliangruber/brace-expansion@ffdfa3e, juliangruber/brace-expansion@33a5ef1). Adds a maxRewrites option that bounds the number of {a},b} rescans (default 1,000).

The runtime dependencies (balanced-match and concat-map on 1.x, balanced-match on 5.x) and the declared Node.js engines are unchanged. The remaining 5.x commits are formatting, CI, SECURITY.md and development dependency updates in the brace-expansion repository.

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement. minimatch 3.1.5 calls expand(pattern) and minimatch 10.2.4 calls expand(pattern, { max: options.braceExpandMax }). Both signatures and the max behavior are unchanged, and the new limits only apply to pathological input far beyond the glob patterns used by ESLint, Jasmine, nyc, Babel and madge in this repository.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Warning

Review limit reached

The included review limit has been reached and this organization has disabled usage-based review continuation. Wait for reviews to reset or ask a billing admin to change After included review limits.

• Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 12 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available. Your 38 included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 87a6dfa5-317f-4183-a3f4-5be9aba52cac

📥 Commits

Reviewing files that changed from the base of the PR and between 67d5418 and 5701a0f.

📒 Files selected for processing: 1

• package-lock.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (67d5418) to head (5701a0f).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #299   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            4         4           
  Lines          159       159           
=========================================
  Hits           159       159           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.