Use brace-expansion >2.0.1

[redsun82]

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

Pull Request Overview

This PR updates the brace-expansion dependency to require version >= 2.0.1, which appears to address a security vulnerability by updating the regular expression pattern used in the brace expansion logic.

• Updates package.json to add explicit brace-expansion dependency with minimum version 2.0.1
• Updates compiled JavaScript files to reflect the new brace-expansion implementation with improved regex pattern
• Fixes a potential ReDoS (Regular Expression Denial of Service) vulnerability in the comma-matching pattern

Reviewed Changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated no comments.

File	Description
package.json	Adds explicit brace-expansion dependency with version constraint >=2.0.1
lib/*.js (multiple files)	Generated JavaScript code reflecting the updated brace-expansion package with security fix

Files not reviewed (1)

• package-lock.json: Language not supported

[mbg]

Minor: I believe the dependencies are in alphabetical order, so it would be good if this addition maintained that order.

[aibaars]

We don't depend on brace-expansion ourselves, right? Perhaps best to try to update the dependency that pulls in the outdated library version.

[redsun82]

unfortunately, that dependency comes from https://www.npmjs.com/package/@actions/glob, which is stuck at 0.5.0 from a year ago

[aibaars]

Let's ask the actions folk to update their dependencies.

[redsun82]

looking better, that dependency points to brace-expansion < 2.0.0, which is not problematic. The only problematic ones are 2.0.0 (that we don't have) and 2.0.1. I tried retracing where that comes from, but in the end just resorted to an explicit override of that specific version

[henrymercer]

Note that we're still pulling in v1.1.12 here — if we want to override this I think we need to modify the overrides property in package.json.

[aibaars]

Either that or update all the dependencies that rely on old versions of brace-expansion

[henrymercer]

Right, if we can update minimatch, that's better. We've had situations before where we've wanted to bump a transient dependency before the direct dependency had bumped it.

[redsun82]

Aha, now I see why dependabot didn't manage to do this update. I'll get back to it on Monday.

[redsun82]

(notice I didn't tell which Monday 😜 😅 on it now)

[henrymercer]

I had a look at the lockfile and we're still pulling in v1.1.11 of brace-expansion — does that need updating too?

[redsun82]

I had a look at the lockfile and we're still pulling in v1.1.11 of brace-expansion — does that need updating too?

No, I double checked and the versions that need updating are just 2.0.0 (which we don't use) and 2.0.1. Versions <2.0.0 are ok.

[henrymercer]

Thanks!