chore(deps): bump brace-expansion to 5.0.9 — Dependabot alert #5 (GHSA-3jxr-9vmj-r5cp)

[Victor-w-Madeira]

Context

Dependabot alert #5 is open against package-lock.json:

• Advisory: GHSA-3jxr-9vmj-r5cp / CVE-2026-13149
• Severity: high — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (CWE-400 / CWE-407)
• Package: brace-expansion 5.0.6, development scope
• Vulnerable range: >= 3.0.0, < 5.0.7

expand_() computes post unconditionally at the top of the function, before the
early-return branches that never use it. For input shaped like a{},{},{},… each level
recurses twice over the same remaining tail and discards one result, giving
T(n) = 2·T(n−1) — O(2ⁿ). The max option does not mitigate it: max only bounds the
output-building loops, not the recursions. Upstream measured 30 {} groups (~90 bytes)
blocking the thread for ~2 minutes.

How it reaches this repo

langflow-e2e@1.0.0
└─┬ eslint@10.1.0
  └─┬ minimatch@10.2.4
    └── brace-expansion@5.0.6

Transitive devDependency only. The exploit needs an attacker-influenced string to
reach expand() or a glob pattern; here the only consumer is ESLint expanding the globs
we author ourselves in eslint.config.js and the testMatch config. There is no
untrusted-input path, so the practical risk to this repo is negligible — this is worth
doing because the fix is three lines of lockfile, not because the exposure is real.

Fix

minimatch@10.2.4 declares brace-expansion: ^5.0.2, so the bump stays inside the
existing range — no package.json change, no major:

npm update brace-expansion --package-lock-only

Resolves to 5.0.9. Verified on a copy outside the repo; the whole diff is the version,
resolved, integrity, and one engines line (18 || 20 || >=22 → 20 || >=22, inert
— every workflow pins node-version: "20"). npm audit reports 0 vulnerabilities after.

Bumping to 5.0.9 also covers alert #6
(GHSA-mh99-v99m-4gvg, unbounded
expansion → OOM crash, A:H, patched in 5.0.8). GitHub auto-dismissed that alert on
2026-07-26, but the defect is present in the 5.0.6 we currently resolve.

Scope

Lockfile only — package-lock.json, three lines plus the engines line.

Out of scope, deliberately: this repo has no .github/dependabot.yml, so only alerting
is enabled and not the updater — which is why these transitive bumps arrive by hand. Adding
a weekly npm config (dev deps grouped) is a separate decision and belongs in its own issue.

Correction (added after an independent review of this issue)

An earlier revision of this issue claimed alert #4 read fixed "because an unrelated
npm install happened to move the resolution, not because anyone acted on it." That was
wrong. da2861d — "chore: bump brace-expansion to 5.0.6", Daniel Licnerski Borges,
2026-05-23 14:20 UTC — is a deliberate, lockfile-only bump of 5.0.4 → 5.0.6, three lines,
exactly the shape of the change proposed here. Alerts #3 and #4 were marked fixed at
15:15 UTC the same day. Someone did act; the claim mischaracterized deliberate work as
accidental and has been removed.

That precedent is worth reading before merging this one, because it also shows why a
manual bump is a moving target rather than a fix: 5.0.6 closed #3 and #4 and was not
vulnerable to anything known in May. GHSA-3jxr-9vmj-r5cp (range < 5.0.7) was published
later — alert #5 was raised 2026-07-21 — so the same 5.0.6 became vulnerable two months
after it landed, without the file changing.

Off-wave note

This does not trace to a Wave 5 item, nor to any of the ROADMAP.md Intake exception
types (follow-up / daily-failure / community). Filing it as an explicit exception
request for a security alert; assign it to the current wave milestone instead if that is
preferred.