fix(deps): brace-expansion <1.1.16 has a high-severity ReDoS advisory (GHSA-3jxr-9vmj-r5cp)

[JSONbored]

Context

npm audit --audit-level=moderate on a clean install currently reports 3 high-severity findings on
main. One is fixable in-range: brace-expansion@1.1.15 (pulled in via eslint@9.39.4 ->
minimatch@3.1.5 -> brace-expansion@^1.1.7, resolved as a devDependency of the
apps/loopover-miner-ui workspace) is vulnerable to GHSA-3jxr-9vmj-r5cp (DoS via exponential-time
expansion of consecutive non-expanding {} groups). brace-expansion@1.1.16 is already published
and satisfies the existing ^1.1.7 range declared by minimatch@3.1.5, so npm update brace-expansion resolves it with a 3-line, single-file package-lock.json diff — no package.json
range change, no other package touched.

This full-tree audit does not currently gate any PR: .github/workflows/audit.yml only runs on a
Monday schedule + workflow_dispatch, and the per-PR security job in .github/workflows/ci.yml
(actions/dependency-review-action) is diff-scoped — it only fails on vulnerabilities a PR's own
lockfile diff introduces, not pre-existing/ambient ones already on main. That's why this doesn't
show red anywhere today despite being a real, fixable finding. renovate.json has
vulnerabilityAlerts.enabled: true, which is the repo's normal path for catching these, but no
Renovate PR has opened for it yet.

The other finding, adm-zip <0.6.0 (GHSA-xcpc-8h2w-3j85, a crafted ZIP triggers a 4GB memory
allocation), is a transitive dependency of github-actionlint, which pins "adm-zip": "^0.5.16".
The patched adm-zip@0.6.0 exists on the registry but falls outside that range (a caret range on a
0.x version only allows patch-level bumps), so npm audit fix can only reach 0.5.18 — still
vulnerable. There's no fix available without either forcing an override past github-actionlint's
declared range (risking breakage in a tool we don't control the internals of) or waiting for
github-actionlint to itself adopt adm-zip@0.6.0.

Requirements

• Bump brace-expansion to 1.1.16 (or later 1.x) via npm update brace-expansion — it must be the
  only package-lock.json entry that changes.
• npm audit --audit-level=moderate must drop from 3 high-severity findings to 1 (only adm-zip,
  documented as a pre-existing, currently-unfixable accepted risk — do not force an override or bump
  github-actionlint to chase it as part of this issue).
• No package.json range change is expected (brace-expansion is a transitive/nested dependency, not
  declared at the root).

Deliverables

• package-lock.json updated so brace-expansion resolves to >=1.1.16.
• npm run test:ci green.
• npm audit --audit-level=moderate shows only the adm-zip finding remaining, with a note (PR
  body) that it's accepted as a known risk pending an upstream github-actionlint update.

Test Coverage Requirements

This is a package-lock.json-only change (no src/** lines touched), so Codecov's codecov/patch
has nothing to cover — npm run test:ci passing unaffected is the validation signal here, not new
tests.

Expected Outcome

npm audit --audit-level=moderate on a clean checkout reports 1 high-severity finding (adm-zip, no
fix available) instead of 3, with the fixable brace-expansion advisory resolved.

Links & Resources

• GHSA-3jxr-9vmj-r5cp — brace-expansion (fixed by this issue)
• GHSA-xcpc-8h2w-3j85 — adm-zip (no fix available, accepted risk, out of scope for this issue)
• .github/workflows/audit.yml, .github/workflows/ci.yml (security job) — why this isn't currently PR-gated
• renovate.json (vulnerabilityAlerts) — the repo's normal path for these going forward

[linear-code]

JSO-5368