fix(deps): update brace-expansion security patches

[BigSimmo]

Summary

• update the maintained brace-expansion override lines to patched releases: 1.1.18, 2.1.4, and 5.0.9
• regenerate the npm lockfile so every resolved brace-expansion node uses the patched maintenance release for its major line
• record the exact-head dependency security review in the branch review ledger

RAG impact: no retrieval behaviour change — the PR diff is limited to dependency overrides, the npm lockfile, and the review ledger; protected RAG files are present only through current-main ancestry.

Verification

• npm run verify:pr-local
  • runtime, installed-lock parity, changed-file formatting, lint, and typecheck passed
  • unit suite reached 434/435 files and 4564 passing tests; six assertions in tests/ci-cache-safety.test.ts failed from Windows Git-Bash multiline argument handling, and that file plus .github/workflows/ci.yml are unchanged from origin/main
  • local build was not run because the repository exclusive build lock remained occupied until the 20-minute caller limit
• direct CVE guard probe passed for installed brace-expansion@1.1.18
• npm audit --omit=dev — 0 vulnerabilities
• npm run check:rag:fixtures — 36 golden cases / 21 suites
• npm run check:branch-review-ledger
• whole-tree Prettier completed and the exact pushed commit passed the pre-push format guard

UI verification not run: no UI, routing, styling, browser, reduced-motion, or forced-colors behavior changed.

Verification not run: local production build could not acquire the exclusive repository lock; hosted required build/checks must pass on this exact head before merge.

Risk and rollout

• Risk: Low. The change stays within the maintained package major lines, but brace expansion is transitively used by ESLint/minimatch and archive tooling, so lint, lock parity, the direct guard, production audit, and hosted build remain release evidence.
• Rollback: Revert the dependency-security squash commit to restore the prior overrides and lockfile.
• Provider or production effects: GitHub PR and hosted CI are explicitly authorized. Merging to main will trigger the repository's normal Railway auto-deploy; no Supabase, OpenAI, hosted migration, or manual deployment action is included.

Notes

• The full development audit may continue to show inherited paths until advisory metadata recognizes the newly published 1.x maintenance backport; the installed 1.1.18 source contains the CVE-specific maxLength guard.
• No application source, retrieval ordering, clinical behavior, database schema, or environment configuration is changed by this PR.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 9 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 21b1275f-87ce-4bb2-81e6-fc18a71844a9

📥 Commits

Reviewing files that changed from the base of the PR and between d018c4f and 87994ce.

📒 Files selected for processing (1)

• docs/branch-review-ledger.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[BigSimmo]

Superseded by #1456. Both PRs apply the same brace-expansion override ranges and resolved lockfile versions, but #1456 also includes a focused regression test in tests/installed-lock-parity.test.ts that pins the vulnerable transitive copies. Keeping one canonical patch avoids duplicate lockfile churn.

[BigSimmo]

@cursoragent this PR will be re-opened soon. Please resolve any failing CI, run bugbot and resolve any bugbot comments against current repo and fix any merge conflicts and also fix any errors and address and fix all comments or suggestions that are likely to improve the PR and Codebase. Please implement smallest required fix according to best code practices. Check your work. Leave this PR closed for now but still make all these changes and run the review. I want it ready to go for when I re-open it.

[cursor]

PR #1460 is still closed. Branch tip 909ffa42 is synced with main and ready for reopen.

What I found

• The brace-expansion product fix already landed in merged build(deps): patch brace-expansion denial of service #1456 (overrides + lockfile + tests/installed-lock-parity.test.ts regression).
• After merging origin/main, this branch has no product delta vs main.
• Unique remaining change: 2 ledger rows in docs/branch-review-ledger.md.
• Bugbot: no cursor[bot] review findings (nothing to fix).
• Prior CI on the old tip was green (PR required SUCCESS); closed PRs don’t refresh head/CI until reopen.

What I did

• Merged current origin/main (merge-tree clean).
• Normalized the ledger to a clean append-only tip.
• Verified: check:branch-review-ledger PASS; lock parity PASS; Vitest installed-lock-parity 6/6; installed brace-expansion@1.1.18 has maxLength.
• Recorded reopen-readiness review in the ledger.
• Pushed branch; left PR closed.

Review verdict

No P0–P2 findings on the remaining unique diff. Reopen is conflict-free, but merge would be ledger-only unless you add new work — the security patch itself is already on main via #1456.

  

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[BigSimmo]

@cursoragent Work this open PR (confirm number + GitHub head first). Start from
origin/ matching that head; preserve unrelated local WIP.
Do not merge, force-push, rebase, or arm auto-merge. No provider-backed
gates without approval. If you can’t push or resolve threads: diagnose +
comment only.

Goal: review + Bugbot the tip, fix actionable issues with smallest changes,
clear merge/required-CI/thread blockers, push fixes, post one PR summary.
Stay light — no full local verify:* / Playwright / broad suites unless
needed to prove one concrete fix. Don’t regenerate large assets unless required.

1. Snapshot tip, behind/ahead, mergeable, merge-tree (real conflict vs
   behind-but-clean), required checks on that tip, unresolved actionable
   threads. Missing checks while dirty ≠ green. If the tip moves mid-work,
   re-snapshot.
   npm run ledger:lookup -- <branch> --scope "PR #<n> review+bugbot+fix".
   If already reviewed at this HEAD/scope and still clean with required checks
   green and no new actionable threads: summarize, comment, stop.

2. Unblock once: real conflict → merge origin/main (for ledger/issues churn,
   prefer main’s queues, keep this PR’s notes); behind-but-clean → sync once
   (wait if required CI is in flight); else leave. No sync thrash.
   If auto-merge is already armed, push only for a real blocker.

3. Review + Bugbot the delta vs base. High-confidence only (correctness,
   security, privacy, auth, data loss, migrations/RLS, clinical/RAG/source,
   prod reliability, user-facing). Separate PR-introduced defects from
   pre-existing re-emitted data. For generated assets, review generator/
   contracts/aliases/cache — not every generated line. If RAG/governance
   surfaces are touched, note/fix PR body only when policy text is wrong
   or missing. Ignore bot summary/rate-limit noise.

4. Fix P0/P1 always; fix clear scoped P2; otherwise short disposition reply
   then resolve. Fix required-check failures on this tip only (ignore advisory).
   Prove with the smallest targeted check only. No broad refactors.

5. Format + commit before push. Push only this PR’s fix commits. Append ledger
   for the final GitHub head + scope above (--supersede on a requested fresh
   same-HEAD pass). Never push a ledger-only tip.

6. Post one concise top-level PR comment: tip SHA, sync, fixed vs dispositioned,
   required CI status, residual risks. Leave merge to me. Inline comments only
   for remaining open P0/P1 needing a human decision.

Stop when merge-tree clean, no actionable threads left, and required checks are
green or clearly in progress on the current tip.

[cursor]

PR #1460 tip 2456a107 is unblocked and under required CI.

Done

1. Snapshot: Open PR fix(deps): update brace-expansion security patches #1460 @ f2cde1ba; GitHub DIRTY, local merge-tree behind-but-clean; unique delta ledger-only; 0 threads; missing CI while dirty ≠ green.
2. Sync: Merged origin/main; main advanced mid-pass (#1521) → synced once more. Now ahead 14 / behind 0, merge-tree clean, mergeable: true.
3. Review + Bugbot: No unresolved threads; no P0–P2 in tip delta. Product brace-expansion already on main via build(deps): patch brace-expansion denial of service #1456.
4. Fix: Cleared ledger ref/HEAD/scope near-duplicate so check:branch-review-ledger passes.
5. Push: f2cde1ba..2456a107 (sync + ledger fix; not ledger-only alone).
6. Comment: Posted on the PR.

Required CI on tip

• Pass: mergeability, PR policy, Change scope, Gitleaks
• In progress: Static PR checks, Semgrep
• Merge left to you. Auto-merge not armed.

  

[cursor]

PR #1460 review+bugbot+fix

Tip: 2456a107 · Base: origin/main (ahead 14 / behind 0) · merge-tree: clean · mergeable: true (blocked on in-flight required checks)

Snapshot / sync

• Confirmed open PR fix(deps): update brace-expansion security patches #1460 at GitHub head f2cde1ba, then re-synced.
• GitHub had reported DIRTY while local merge-tree was behind-but-clean (not a content conflict).
• Merged origin/main once; main advanced mid-pass (#1521), so synced once more. No rebase/force-push/auto-merge.
• Cleared a post-merge ledger near-duplicate (ref/HEAD/scope collision with a main-side row) so check:branch-review-ledger passes.

Review + Bugbot

• Unique tip delta vs main: docs/branch-review-ledger.md only.
• Product brace-expansion patch already on main via build(deps): patch brace-expansion denial of service #1456 (overrides + lockfile + regression test).
• Bugbot / review threads: none unresolved. No P0–P2 findings in the tip delta.
• Ignored CodeRabbit rate-limit/summary noise. PR body still describes the original package/lockfile change set (integration could not edit the body); tip itself is ledger-only.

Fixed vs dispositioned

Item	Disposition
GitHub DIRTY / missing CI while dirty	Fixed — synced to current main; mergeability now pass
Ledger near-duplicate guard failure after merge	Fixed — dropped colliding re-append; kept intentional notes
Bugbot / Codex / human threads	None
Product deps CVE work	Already on main via #1456 — not re-applied

Required CI

• PR mergeability: pass on 2456a107
• PR policy / Change scope / Gitleaks: pass
• Static PR checks / Semgrep: in progress on this tip
• Prior missing checks while DIRTY were not treated as green

Residual risks

• Tip is documentation/ledger-only vs current main; merging adds no further brace-expansion product change.
• PR Summary body still talks about package/lockfile updates; worth a human refresh if you want the description to match the tip.
• Leave merge to you.