CVE-2026-13149: backport CVE fix to release-1.2

[celdrake]

CVE Fix backport — release-1.2

Backport of #735

Vulnerabilities Addressed

CVE ID	Severity	Package	Old Version	New Version
CVE-2026-13149	High	brace-expansion	1.1.13 / 5.0.5	1.1.16 / 5.0.7

Related Jira: EDM-4734–EDM-4737 (rhem-1.2 trackers).

Strategy

Clean cherry-pick of merge commit edb19c3 from main.

Rollback

git revert <commit-sha>

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 1f3451bc-e2a4-4bbc-be0f-343f62aea7e9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}