build(deps): patch brace-expansion denial of service

[BigSimmo]

Summary

• Patch the transitive brace-expansion dependency across maintained major lines.
• Pin installed versions to 1.1.18 and 5.0.9, which contain bounded expansion output handling for CVE-2026-14257 / GHSA-mh99-v99m-4gvg.
• Add a regression test that proves adversarial expansion stays within the configured output budget while ordinary brace expansion remains compatible.

RAG impact: no retrieval behaviour change — this is a development dependency override, lockfile security patch, and dependency regression test only.

Verification

• npm run check:installed-lock-parity
• npm run format:changed
• npm run format (exact merged tree; 1,771 files checked, all unchanged)
• Direct CVE adversarial proof: output bounded at 40,000 characters across 400 results
• Ordinary brace-expansion and legacy minimatch compatibility smoke checks
• npm run verify:pr-local

Verification not run locally: the repository coordinator remained occupied by another worktree's atomic verify:pr-local, lint, and full Vitest runs. Exact-head hosted CI is the authoritative broad gate for this PR.

npm audit --json still reports the advisory because its range metadata currently marks all brace-expansion <=5.0.7 as affected and does not model the newly published 1.1.18 maintenance backport. The installed 1.1.18 source contains the CVE-specific maxLength bound, and the regression test exercises that behavior. An ESLint 10 force-upgrade was deliberately avoided because it is an unrelated semver-major migration.

UI verification not run: no UI, routing, styling, or browser behavior changed.

Risk and rollout

• Risk: Low. This changes transitive development-tool dependencies and adds a bounded-output regression test; ordinary expansion and the legacy minimatch consumer were smoke-tested.
• Rollback: Revert the dependency patch commit and regenerate package-lock.json.
• Provider or production effects: GitHub branch and PR only; no deployment or production data effects.

Clinical Governance Preflight

Not applicable: no ingestion, answer generation, retrieval/ranking, source rendering, document access, privacy, production environment, or clinical output behavior changed.

Notes

• Dependabot alert: GHSA-mh99-v99m-4gvg / CVE-2026-14257.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 40 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b1742674-eea8-4c83-862a-45e791ddf3a2

📥 Commits

Reviewing files that changed from the base of the PR and between d4cee1c and 4a17713.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• tests/installed-lock-parity.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[BigSimmo]

Local focused verification completed after the shared coordinator released:
pm test -- tests/installed-lock-parity.test.ts -> 1 test file passed, 6 tests passed, duration 1.11s. This includes the CVE-2026-14257 bounded-expansion regression and ordinary expansion compatibility assertion.