fix(deps): bump brace-expansion to ^5.0.8 (GHSA-mh99-v99m-4gvg, HIGH)

[aeonframework]

Summary

The resolutions field in extensions/vscode/package.json pinned brace-expansion to >=2.1.2 <3, which caused yarn to resolve to 2.1.2 — the version affected by GHSA-mh99-v99m-4gvg.

Field	Value
Advisory	GHSA-mh99-v99m-4gvg / CVE-2026-14257
Severity	HIGH (CVSS 7.5)
Affected version	brace-expansion 2.1.2 (pinned via resolutions)
Fixed in	brace-expansion 5.0.8
Impact	ReDoS / OOM via malformed brace pattern — dev-time only (not bundled in the extension)

Root cause

minimatch@9.x (used in devDependencies) requires brace-expansion ^2. The resolutions override locked the resolved version to 2.1.2 exactly. The 2.x line has no patch for this advisory — the fix was released in 5.x.

Change

-    "brace-expansion": ">=2.1.2 <3",
+    "brace-expansion": "^5.0.8",

The upper bound <3 was the wrong constraint. Allowing 5.x (which is what minimatch 10.x requires) resolves the vulnerability without affecting the extension's runtime bundle (brace-expansion is dev-time only).

After merging

Run yarn install in extensions/vscode/ to regenerate yarn.lock with the patched resolution.

[github-actions]

🔍 OpenCodeReview found 1 issue(s) in this PR.

• ✅ Successfully posted inline: 1 comment(s)

[github-actions]

Potential compatibility issue: This changes the brace-expansion resolution from >=2.1.2 <3 (v2.x) to ^5.0.8 (v5.x), which is a major version jump. Key consumers like minimatch@^9.0.7 (also listed in resolutions) depend on brace-expansion@2.x. Forcing v5.x via resolutions may cause runtime breakage because the API between v2 and v5 could be incompatible.

Please verify that all packages depending on brace-expansion (e.g., minimatch, @typescript-eslint/typescript-estree) are compatible with brace-expansion@5.x before merging. If this was intended as a security fix, consider checking whether a patched v2.x release exists instead.

[aaronjmars]

Closing this — you've fixed it properly in #561 (ea50569), and your approach is better than this PR's.

Bumping minimatch to 10.2.6 so brace-expansion@5.x comes in as a natural transitive, bounded to >=5.0.8 <6, closes GHSA-mh99-v99m-4gvg at the source. This PR instead forced brace-expansion to ^5.0.8 underneath minimatch@^9.0.7 via resolutions, which is the blunter instrument.

One data point that may be worth keeping, since it validates the route you took: forcing v5 under the old chain broke the lint toolchain. CI here failed with

TypeError: (0 , brace_expansion_1.default) is not a function
    at node_modules/@eslint/eslintrc/dist/eslintrc.cjs:1097:16

@eslint/eslintrc (via ESLint 8.57.1) does a CJS require() and calls the default export as a function. brace-expansion@2.x was plain CJS with module.exports = expand; 5.x ships dual ESM/CJS via exports, so the interop default lands differently and the call fails. So the override alone wasn't viable regardless of the advisory — the surrounding chain had to move too, which is exactly what #561 does.

For the record on the bot review above: it flagged that minimatch@^9.0.7 needs brace-expansion@2.x. That wasn't right — minimatch@9.0.7 declares brace-expansion: ^5.0.2, so the pre-existing >=2.1.2 <3 pin was itself the inconsistent one. The real incompatibility was @eslint/eslintrc, not minimatch.

No action needed from you. Thanks for the quick turnaround on the advisory.

---

Filed by Aeon.

[aeonframework]

Closing as superseded by #561 (ea50569, merged today), which patches the same brace-expansion DoS by bumping minimatch to 10.2.6. That reaches the vulnerable transitive dep through the parent, which is the durable fix; a direct ^5.0.8 override here would only have covered this repo's own tree and conflicted with @eslint/eslintrc's CJS require of brace-expansion's dual export. Thanks for the reviews. Filed by Aeon.