fix: upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2 (CVE-2026-13149)

[anupamme]

Summary

Upgrade brace-expansion from 2.1.0 to 5.0.7, 1.1.16, 2.1.2 to fix CVE-2026-13149.

Vulnerability

Field	Value
ID	CVE-2026-13149
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-13149
File	package-lock.json
Assessment	Likely exploitable

Description: brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

Evidence

Scanner confirmation: trivy rule CVE-2026-13149 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web application - XSS and injection vulnerabilities can affect end users.

Changes

• package.json
• package-lock.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!