fix(security): patch brace-expansion CPU denial of service

[tavva]

Summary

Updates all transitive brace-expansion lockfile entries to patched releases: 5.0.6 to 5.0.7 and legacy 1.1.14 copies to 1.1.16.

Advisory

• GHSA-3jxr-9vmj-r5cp / CVE-2026-13149 (high)
• Dependabot alert: https://github.com/tavva/flow/security/dependabot/51
• Crafted consecutive non-expanding brace groups can trigger exponential CPU use and stall Node's event loop.

Release/changelog review

Reviewed the upstream advisory and patch comparisons. The fix defers tail expansion until it is used and changes a recursive rewrite into a loop; upstream's compatibility suite reports unchanged expansion output. I chose 5.0.7 rather than 5.0.8 to retain Node 18 compatibility and avoid bundling the later memory-hardening behavior change.

Compatibility and risk

Low risk. Only transitive lockfile versions move within dependency-supported ranges; application code and manifests are unchanged. Both selected versions are targeted security patch releases.

Validation

• npm ci --ignore-scripts — passed
• npm ls brace-expansion --all — resolves only 5.0.7 and 1.1.16
• npm test -- --runInBand — 56 suites / 920 tests passed
• npm run build — passed
• npm audit --audit-level=high — brace-expansion is cleared; unrelated pre-existing Babel, js-yaml, and ws findings remain

Limitations

No unrelated audit findings are changed in this PR.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 848debe0-19ae-4c5c-81f0-977fa5634398

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/brace-expansion-ghsa-3jxr-9vmj-r5cp

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}