fix: upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2 (CVE-2026-13149)

[anupamme]

Summary

Upgrade brace-expansion from 5.0.6 to 5.0.7, 1.1.16, 2.1.2 to fix CVE-2026-13149.

Vulnerability

Field	Value
ID	CVE-2026-13149
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-13149
File	package-lock.json
Assessment	Likely exploitable

Description: brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

Evidence

Scanner confirmation: trivy rule CVE-2026-13149 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• package.json
• package-lock.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

Summary by CodeRabbit

• Chores
  • Added support for brace expansion in the application’s dependency set.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 679b83b6-4868-4fed-91d9-f4cc7c81099a

📥 Commits

Reviewing files that changed from the base of the PR and between bcb1b7f and 810f126.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

Adds brace-expansion version ^5.0.7 to the package.json dependencies.

Changes

Dependency Update

Layer / File(s)	Summary
Add brace-expansion dependency package.json	Adds brace-expansion at version ^5.0.7 without changing other package settings.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: smixs

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the security-related brace-expansion dependency upgrade and the CVE being addressed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[smixs]

Спасибо за репорт и PR! Уязвимость закрыта в v0.3.6 — brace-expansion поднят до 5.0.8 (см. CHANGELOG, там отмечен и ваш вклад по #69). Этот PR предлагает более раннюю 5.0.7, так что закрываю как superseded. npm audit на main чистый.

[anupamme]

Спасибо за оперативность и за то, что закрыли уязвимость в v0.3.6 (#69)! Логично, что этот PR стал избыточным раз 5.0.8 новее. Спасибо, что отметили вклад в CHANGELOG.