fix(deps): raise brace-expansion to 5.0.9 for GHSA-rgw5-rvv9-x895

[marc0olo]

GHSA-rgw5-rvv9-x895, high severity, published today: brace-expansion >=4.0.0 <5.0.9, patched only in 5.0.9.

main pins 5.0.8, so main is affected and audit:required currently fails on every open pull request — #76, #78, #80, #81 and #82 alike. Nothing in those pull requests caused it; pnpm audit queries the live advisory database, so the same lockfile flipped from pass to fail with no code change.

The policy tension, stated plainly

#79 pinned 5.0.8 deliberately, because 5.0.9 was four days old and inside the seven-day minimumReleaseAge window that pnpm-workspace.yaml enforces. Overrides appear to bypass that gate, so the exact pin was how the policy got respected.

That reasoning no longer holds now that 5.0.9 is the only patched version. This PR knowingly takes a package that is four days old, on the grounds that a live high-severity advisory outweighs a quarantine which 5.0.9 clears on 2026-08-06 anyway — a three-day exposure either way, and the alternative is leaving every pull request red until then.

If you would rather not breach the window, the alternatives are waiting until the 6th, or adding a minimumReleaseAgeExclude entry, which is a broader policy change.

Verification

pnpm audit → no known vulnerabilities (was 1 high). No action bundles change, since brace-expansion is reached through rimraf, a devDependency that is not bundled into the actions. Two files only.

Recommended merge order

1. This PR — clears audit:required on everything else.
2. chore: generate changelog #82 — merge or close it before feat(create-pr): add reuse_branch to keep one self-updating pull request #80 lands. It sits on a suffixed branch that feat(create-pr): add reuse_branch to keep one self-updating pull request #80's reuse_branch behaviour will orphan. Its fate depends on whether this repo keeps a changelog at all, given it has never released: zero tags, no release workflow, and a CHANGELOG.md that is one permanent Unreleased section.
3. chore: mark action bundles as generated and cover extract-version in check_dist #81 — collapses generated bundles in reviews. Independent of everything.
4. fix(generate-changelog): do not fail on release commits or empty changelogs #78 and feat(create-pr): add reuse_branch to keep one self-updating pull request #80, either order. Both touch .github/workflows/generate-changelog.yaml; they auto-merge cleanly, so the second one only needs a rebase.
5. build(deps-dev): bump esbuild from 0.25.12 to 0.28.1 #76 — last. It needs someone to check the branch out and run pnpm build, since dependabot cannot rebuild the bundles.

🤖 Generated with Claude Code