From d184098249e833a9d60bf1f2705d26b327842871 Mon Sep 17 00:00:00 2001
From: Manuel Puyol <manuelpuyol@github.com>
Date: Mon, 3 Aug 2026 16:22:53 -0400
Subject: [PATCH] Pin brace-expansion@1 to a patched release via override

The remaining high-severity brace-expansion advisories could not be
resolved by 'npm audit fix' -- it converges without moving the pinned
transitive copy.

Adds a version-scoped override so the v1 line resolves to a patched
release, leaving the v2 and v5 copies (already patched) untouched:
  brace-expansion@1 -> ^1.1.18 (was 1.1.13, via @eslint/eslintrc)

Build, lint and tests pass.
---
 package-lock.json | 14 +++++++-------
 package.json      |  3 ++-
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c850d7e..d848823 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1168,9 +1168,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
-      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5706,9 +5706,9 @@
       "dev": true
     },
     "brace-expansion": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
-      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "requires": {
         "balanced-match": "^1.0.0",
@@ -7220,7 +7220,7 @@
       "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "requires": {
-        "brace-expansion": "^1.1.7"
+        "brace-expansion": "^1.1.18"
       }
     },
     "minimist": {
diff --git a/package.json b/package.json
index aaa6a60..228541e 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,7 @@
     "mocha": {
       "js-yaml": "^5.2.2",
       "serialize-javascript": "^7.0.5"
-    }
+    },
+    "brace-expansion@1": "^1.1.18"
   }
 }