fix(deps): bump brace-expansion to 5.0.8 (CVE-2026-14257)

[luflow]

Replaces #116, which addressed the same advisory but in a way that would have made things worse.

What

npm audit flags brace-expansion <= 5.0.7 as a high-severity DoS (unbounded expansion → OOM crash), GHSA-mh99-v99m-4gvg / CVE-2026-14257.

The hoisted 5.0.7 instance was only pinned by the lockfile. The declaring ranges already permit 5.0.8, so npm update brace-expansion is the whole fix — no package.json change and no overrides entry needed, and the entry stays dev: true.

The lockfile's version field also drifted (1.40.0 vs. 1.41.2 in package.json); this syncs it.

Coverage

Every brace-expansion in the tree comes in via minimatch:

Path	Version
eslint@10.7.0 → minimatch@10.2.5	5.0.8	fixed here
@nextcloud/vite-config → vite-plugin-dts → @microsoft/api-extractor → minimatch@10.2.3	5.0.8	fixed here (deduped)
@nextcloud/dialogs → webdav → minimatch@9.0.9	2.1.2	remains — only non-dev path
@nextcloud/vite-config → vite-plugin-dts → @vue/language-core → minimatch@9.0.9	2.1.2	remains, dev-only

npm audit reports "No fix available" for the two 2.1.2 paths: 2.1.2 is the latest maintenance-v2 release and upstream shipped no 2.x backport.

Overriding them to 5.x is not viable. minimatch@9 does __importDefault(require("brace-expansion")) and calls the default export; v2 is a function, whereas v5 is ESM-first and exports a { expand, … } object — the call would throw at runtime.

Impact of the remainder is low regardless: brace-expansion is not imported anywhere in src/, never reaches the Vite bundle, and the input to minimatch here is glob patterns from build tooling, not user data. Left for upstream.

Verification

• npm run build passes
• npm audit no longer lists node_modules/brace-expansion (3 flagged paths → 2)
• Lockfile integrity hash matches registry.npmjs.org for brace-expansion@5.0.8
• Diff is package-lock.json only, 6 lines