Fix 24 high severity vulnerabilities by overriding brace-expansion to 5.0.8

[dependabot]

Description:

Fixes 24 high severity vulnerabilities caused by two CVEs in brace-expansion:

• CVE-2026-13149 (GHSA-3jxr-9vmj-r5cp) — DoS via exponential-time expansion
• CVE-2026-14257 (GHSA-mh99-v99m-4gvg) — DoS via unbounded expansion causing OOM crash

Root cause

All 24 vulnerabilities traced back to a single root: brace-expansion ≤ 5.0.7 across three dependency chains — eslint, @typescript-eslint, and jest. The second CVE has no patch in v1 or v2, making 5.0.8 the only safe version.

Fix

Added a single overrides entry in package.json:

  "overrides": {
-   "undici": "6.27.0"
+   "brace-expansion": "5.0.8"
}

• Removed the redundant undici override — @actions/github@9.1.1 already declares ^6.23.0, which naturally resolves to 6.27.0
• brace-expansion@5.0.8 ships dual CJS + ESM exports, making it a safe drop-in for all consumers (minimatch@3, @9, @10)
• Also bundles fast-xml-parser@5.10.1 (from Dependabot) and updates license cache accordingly

Why not --force

npm audit fix --force would downgrade jest 30.4.2 → 25.0.0 — a 5 major version regression that breaks ES module support. It also doesn't fully eliminate the vulnerabilities; it just replaces the chain with an older one that predates CVE indexing.

Verification

• npm audit — 0 vulnerabilities (was 24 high)
• Tests — 1360 / 1360 passing across 29 suites
• Build, lint, format — clean
• licensed status — 63 dependencies, 0 errors
• Lock file regenerated and verified deterministic

offtopic