fix(deps): patch brace-expansion DoS (GHSA-rgw5-rvv9-x895) [DEVX-8507]

[warp-agent-staging]

Summary

Fixes DEVX-8507: GHSA-rgw5-rvv9-x895 / CVE-2026-69152 ("brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"), flagged as Dependabot alert #35. The maxLength mitigation added in brace-expansion@5.0.8 for the earlier advisory (GHSA-mh99-v99m-4gvg / CVE-2026-14257) only bounded the accumulator in combine(), not the intermediate arrays feeding it — a ~25 KB input can crash Node with an uncatchable OOM, and a ~400 KB padded-sequence input can block the event loop for minutes. Applications already on 5.0.8 are affected.

This repo had two vulnerable copies of brace-expansion, both only in package-lock.json and both dev-scope transitive dependencies with no production/runtime exposure:

1. node_modules/brace-expansion — pulled in by minimatch@3.1.5 (^1.1.7, via @eslint/eslintrc), was 1.1.16, needed >= 1.1.18.
2. node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion — pulled in by minimatch@10.2.6 (requesting brace-expansion ^5.0.8, via @typescript-eslint/typescript-estree), was 5.0.8, needed >= 5.0.9.

Alert 35 is auto_dismissed by an auto-triage rule for dev-scope transitive deps, so Dependabot will not open a PR for it — this fix was made explicitly instead.

Changes

• Updated the overrides block in package.json. Replaced the prior "brace-expansion@>=3.0.0 <5.0.7": "5.0.7" pin with one entry per vulnerable major line, each mapped to that line's own first patched version (mirroring the advisory's range → patch mapping exactly, with no cross-major jumps):

  • "brace-expansion@<1.1.18": "1.1.18"
  • "brace-expansion@>=2.0.0 <2.1.4": "2.1.4"
  • "brace-expansion@>=3.0.0 <3.0.6": "3.0.6"
  • "brace-expansion@>=4.0.0 <5.0.9": "5.0.9"

  A single wide >=3.0.0 <5.0.9 -> 5.0.9 override (an earlier draft of this fix) had two problems: it left the 2.x range (>=2.0.0 <2.1.4) completely uncovered since there was no 2.x key, and 5.0.9 falls outside normal 3.x/4.x semver-consumer ranges so npm would not force it onto nested consumers requesting exact 3.x/4.x versions, leaving them on vulnerable versions. The per-major mapping above closes both gaps and is a deliberate departure from the old >=3.0.0 <5.0.7 pin, which forced 3.x consumers onto the 5.x line — 3.0.6 is patched and supports Node >=18 (vs. 5.0.9's 20 || >=22 engines requirement), so the narrower mapping is strictly safer for engine compatibility. The 2.x and 3.x keys are defense-in-depth for the current dependency tree (no 2.x/3.x copy is currently resolved) and are confirmed inert against it — regenerating the lockfile with the four-entry override produced an identical package-lock.json to the previous (1.1.18/5.0.9-only) revision.

  • Left the postcss, sharp, and js-yaml override entries untouched.

• Regenerated package-lock.json via npm install. No application source, config, or production dependencies were changed.

Verification

• npm install — regenerated the lockfile; resolved tree unchanged from the prior revision for the copies that actually exist.
• npm ls brace-expansion --all:

  do-things@0.1.0 /workspace/do-things
  +-- @eslint/eslintrc@3.3.6
  | `-- minimatch@3.1.5
  |   `-- brace-expansion@1.1.18 overridden
  `-- eslint-config-next@15.2.2
    `-- @typescript-eslint/parser@8.65.0
      `-- @typescript-eslint/typescript-estree@8.65.0
        `-- minimatch@10.2.6
          `-- brace-expansion@5.0.9 overridden
  

  Both resolved copies are in patched ranges (1.1.18 >= 1.1.18, 5.0.9 >= 5.0.9). Zero copies remain in a vulnerable range.
• npm audit — no brace-expansion advisory remains. Two pre-existing, unrelated advisories remain (nanoid < 3.3.18, high; postcss <= 8.5.22 incomplete-fix, moderate) — out of scope for this change, not fixed here.
• npm run build — succeeded (✓ Compiled successfully, ✓ Linting and checking validity of types).
• npm run lint — succeeded (✔ No ESLint warnings or errors). This is the meaningful regression check since the 5.x copy is consumed by @typescript-eslint.
• Lockfile diff reviewed: the only brace-expansion-related entries changed are the two resolved copies (1.1.16 → 1.1.18, 5.0.8 → 5.0.9); the new 2.x/3.x override keys did not add or change any lockfile entries.

Ref: DEVX-8507

Co-Authored-By: Warp agent@warp.dev

[warp-agent-staging]

This PR was generated with Warp.