fix: upgrade brace-expansion to patched versions (CVE-2026-14257)

[ASolarers-Rodriguez]

Summary

Fixes CVE-2026-14257 (brace-expansion regex denial-of-service, GHSA-mh99-v99m-4gvg) for superset-frontend with a lockfile-only change: no package.json edits.

Every dependent in superset-frontend/package-lock.json that pulls in brace-expansion already declares a caret range (^1.1.7, ^2.0.1/^2.0.2, ^5.0.2/^5.0.5) that permits the patched same-major releases. The lockfile was simply pinned to older, vulnerable patch versions. Regenerating the lock (npm update brace-expansion) moves every resolution to a patched version with zero package.json diff:

Location	Before	After
node_modules/brace-expansion (root)	1.1.16	1.1.17
@jest/reporters	2.1.2	2.1.3
filelist	2.1.2	2.1.3
jest-config	2.1.2	2.1.3
jest-runtime	2.1.2	2.1.3
@typescript-eslint/typescript-estree	5.0.7	5.0.8
typescript-json-schema	5.0.7	5.0.8

That's 7 of the 19 total brace-expansion lock entries; the other 12 were already resolved to a patched version (1.1.17 / 2.1.3 / 5.0.8) before this change.

Why not overrides (superseding #42435)

#42435 attempted to fix this with a package.json overrides block forcing brace-expansion to 1.1.17/2.1.3/5.0.8 globally. That approach broke lint-frontend/validate-frontend (see #42435 comment): the root minimatch@3.1.4 dependency — pinned by lerna and resolved transitively by eslint-plugin-import (part of the lint chain) — depends on brace-expansion@^1.1.7 (the 1.x API). Forcing that resolution to 5.0.8 is a 4-major-version jump whose API no longer matches what Minimatch.braceExpand expects, producing TypeError: expand is not a function.

This PR instead bumps only the resolutions that are actually vulnerable, each staying within its own dependent's existing semver range, so the minimatch@3.x/brace-expansion@1.x chain used by lint is untouched (it moves from 1.1.16 to 1.1.17, both within the same API generation).

Test plan

• npm update brace-expansion regenerates the lock with the 7 resolutions above; confirmed zero package.json diff (git diff --stat shows only package-lock.json).
• npx eslint --version resolves cleanly (v10.7.0) after the lockfile change.
• Sanity check that the minimatch/brace-expansion chain still loads and works: require('minimatch')('src/foo.tsx', 'src/**/*.{ts,tsx}') returns true, and minimatch.braceExpand('{a,b,c}.js') returns ['a.js','b.js','c.js'].
• Full lint-frontend / validate-frontend / test suite left to CI.

Advisory: GHSA-mh99-v99m-4gvg
CVE: CVE-2026-14257

[bito-code-review]

Bito Automatic Review Skipped - Files Excluded

Bito didn't auto-review this change because all changed files are in the exclusion list for automatic reviews. No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change the excluded files settings here, or contact your Bito workspace admin at evan@preset.io.

[ASolarers-Rodriguez]

Verified this locally against the resolved superset-frontend tree (Node v24.16.0 per .nvmrc), addressing GHSA-mh99-v99m-4gvg / CVE-2026-14257 (DoS via unbounded expansion length; fixed per major line at brace-expansion 1.1.17 / 2.1.3 / 5.0.8, per the npm registry publish history):

npm ls brace-expansion --all — every resolved instance across the dependency tree is at a patched version, none below:

$ npm ls brace-expansion --all 2>/dev/null | grep -oE 'brace-expansion@[0-9.]+' | sort -u
brace-expansion@1.1.17
brace-expansion@2.1.3
brace-expansion@5.0.8

git diff against the merge-base confirms this is a lockfile-only change:

$ git diff <merge-base> HEAD --stat
 superset-frontend/package-lock.json | 46 ++++++++++++++++++-------------------
 1 file changed, 23 insertions(+), 23 deletions(-)

Before contrast (upstream/master:superset-frontend/package-lock.json) shows the old vulnerable pins this PR replaces:

node_modules/brace-expansion: 1.1.16
.../node_modules/brace-expansion: 2.1.2  (multiple nested instances)
.../node_modules/brace-expansion: 5.0.7  (multiple nested instances)

All post-bump instances land on 1.1.17 / 2.1.3 / 5.0.8, matching the fixed versions in the advisory.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.33%. Comparing base (673f928) to head (26e27e7).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #42583      +/-   ##
==========================================
- Coverage   65.33%   65.33%   -0.01%     
==========================================
  Files        2803     2803              
  Lines      158490   158481       -9     
  Branches    36178    36176       -2     
==========================================
- Hits       103557   103545      -12     
- Misses      52922    52924       +2     
- Partials     2011     2012       +1     

Flag	Coverage Δ
javascript	71.46% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[bito-code-review]

Bito Automatic Review Skipped – PR Already Merged

Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.
No action is needed if you didn't intend to review it. To get a review, you can type /review in a comment and save it