fix: update brace-expansion to 5.0.8 and upgrade Alpine base image to 3.22

[Copilot]

Daily container image scan flagged cli-proxy:0.27.41 with high-severity vulnerabilities including brace-expansion GHSA-mh99-v99m-4gvg, golang.org/x/text, google.golang.org/grpc, and Alpine base CVEs.

Fixes applied in this repo

• brace-expansion 5.0.5 → 5.0.8 in actions/setup/js (GHSA-mh99-v99m-4gvg)
• brace-expansion 5.0.7 → 5.0.8 in eslint-factory (GHSA-mh99-v99m-4gvg)
• Alpine 3.21 → 3.22 in Dockerfile (gh-aw compiler image)
• Recompiled all 264 workflow lock files (2 passes)

Already addressed upstream

DefaultFirewallVersion was already at v0.27.42, which includes:

• fix: update brace-expansion to 5.0.8 in the cli-proxy container
• fix(supply-chain): ignore unreachable x/text CVE embedded in gh CLI binary
• Go deps in go.mod already satisfy minimums: x/text v0.40.0, grpc v1.82.1, Go 1.26.5

Remaining (needs gh-aw-firewall bump beyond v0.27.42)

tar, google.golang.org/grpc, and Go stdlib vulnerabilities inside the cli-proxy binary are owned by the gh-aw-firewall build and require a future upstream release.

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/cli-proxy #48147

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 21.7 AIC · ⌖ 7.59 AIC · ⊞ 7.2K · ◷
_{Comment /souschef to run again}

---

Run URL: https://github.com/github/gh-aw/actions/runs/30337076577

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.94 AIC · ⌖ 5.43 AIC · ⊞ 7.2K · ◷
_{Comment /souschef to run again}

[Copilot]

Pull request overview

Updates vulnerable JavaScript dependencies and refreshes the compiler container base image.

Changes:

• Updates vulnerable brace-expansion versions.
• Upgrades Alpine from 3.21 to 3.22.
• Recompiles workflow metadata.

Show a summary per file

File	Description
eslint-factory/package-lock.json	Updates brace-expansion to 5.0.8.
actions/setup/js/package-lock.json	Updates vulnerable brace-expansion dependency lines.
Dockerfile	Upgrades the Alpine base image.
.github/workflows/smoke-copilot-auto.lock.yml	Refreshes generated workflow metadata.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files not reviewed (2)

• actions/setup/js/package-lock.json: Generated file
• eslint-factory/package-lock.json: Generated file

• Files reviewed: 2/4 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

✅ Great work resolving the container image security findings! This PR follows the project's core-team agentic workflow model perfectly.

The fix is focused and well-documented:

• ✅ Clear summary of vulnerabilities addressed in this repo vs. upstream
• ✅ Updates brace-expansion to 5.0.8 (GHSA-mh99-v99m-4gvg)
• ✅ Upgrades Alpine base image to 3.22
• ✅ Recompiles 264 workflow lock files appropriately
• ✅ Acknowledges remaining items that require gh-aw-firewall upstream release

This PR is ready for review — it looks like a solid supply-chain security improvement. 🛡️

Generated by ✅ Contribution Check · sonnet50 · 50.8 AIC · ⌖ 10.4 AIC · ⊞ 8.3K · ◷

[github-actions]

PR Triage

• Category: chore (security) | Risk: low | Score: 73/100
• Impact 30 · Urgency 25 · Quality 18
• Recommended action: fast_track

Addresses flagged high-severity vulnerabilities (brace-expansion, Alpine base). Small diff, CI green. Good candidate for expedited merge after human sign-off.

Generated by 🔧 PR Triage Agent · sonnet50 · 50.9 AIC · ⌖ 5.23 AIC · ⊞ 7.5K · ◷