build(deps): patch brace-expansion denial of service

package.json

@@ -241,9 +241,9 @@
     "sharp": "0.35.3",
     "tmp": "^0.2.7",
     "uuid": "^11.1.1",
-    "brace-expansion@1": "^1.1.16",
-    "brace-expansion@2": "^2.1.2",
-    "brace-expansion@5": "^5.0.8",
+    "brace-expansion@1": "^1.1.18",
+    "brace-expansion@2": "^2.1.4",
+    "brace-expansion@5": "^5.0.9",
     "exceljs": {
       "archiver": "^8.0.0",
       "unzipper": "^0.12.5"

tests/installed-lock-parity.test.ts

@@ -1,10 +1,12 @@
 import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
 import os from "node:os";
 import path from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
 import { criticalInstalledPackages, installedLockParity } from "../scripts/check-installed-lock-parity.mjs";
 
 const temporaryRoots: string[] = [];
+const requireFromTest = createRequire(import.meta.url);
 
 function fixture(lockedVersion: string, installedVersion?: string) {
   const root = mkdtempSync(path.join(os.tmpdir(), "installed-lock-parity-"));
@@ -72,4 +74,34 @@ describe("installedLockParity", () => {
     );
     expect(ci).toContain("run: npm run check:installed-lock-parity");
   });
+
+  it("keeps brace-expansion on CVE-2026-14257-patched maintenance releases", () => {
+    const packageJson = JSON.parse(readFileSync(path.resolve("package.json"), "utf8")) as {
+      overrides: Record<string, string>;
+    };
+    const lock = JSON.parse(readFileSync(path.resolve("package-lock.json"), "utf8")) as {
+      packages: Record<string, { version?: string }>;
+    };
+    const expand = requireFromTest("brace-expansion") as (
+      input: string,
+      options?: { max?: number; maxLength?: number },
+    ) => string[];
+
+    expect(packageJson.overrides).toMatchObject({
+      "brace-expansion@1": "^1.1.18",
+      "brace-expansion@2": "^2.1.4",
+      "brace-expansion@5": "^5.0.9",
+    });
+    expect(lock.packages["node_modules/brace-expansion"]?.version).toBe("1.1.18");
+    expect(
+      Object.entries(lock.packages)
+        .filter(([name]) => name.endsWith("node_modules/brace-expansion"))
+        .map(([, entry]) => entry.version),
+    ).toEqual(expect.arrayContaining(["1.1.18", "5.0.9"]));
+
+    const maxLength = 40_000;
+    const adversarial = expand("{a,b}".repeat(100), { max: 100_000, maxLength });
+    expect(adversarial.reduce((total, value) => total + value.length, 0)).toBeLessThanOrEqual(maxLength);
+    expect(expand("a{b,c}d")).toEqual(["abd", "acd"]);
+  });
 });