Use brace-expansion >= 2.0.1

[redsun82]

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

Pull Request Overview

This PR updates the brace-expansion dependency to require version >= 2.0.1, which appears to address a security vulnerability by updating the regular expression pattern used in the brace expansion logic.

• Updates package.json to add explicit brace-expansion dependency with minimum version 2.0.1
• Updates compiled JavaScript files to reflect the new brace-expansion implementation with improved regex pattern
• Fixes a potential ReDoS (Regular Expression Denial of Service) vulnerability in the comma-matching pattern

Reviewed Changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated no comments.

File	Description
package.json	Adds explicit brace-expansion dependency with version constraint >=2.0.1
lib/*.js (multiple files)	Generated JavaScript code reflecting the updated brace-expansion package with security fix

Files not reviewed (1)

• package-lock.json: Language not supported

[mbg]

Minor: I believe the dependencies are in alphabetical order, so it would be good if this addition maintained that order.

[aibaars]

We don't depend on brace-expansion ourselves, right? Perhaps best to try to update the dependency that pulls in the outdated library version.

[henrymercer]

Note that we're still pulling in v1.1.12 here — if we want to override this I think we need to modify the overrides property in package.json.

[aibaars]

Either that or update all the dependencies that rely on old versions of brace-expansion

[henrymercer]

Right, if we can update minimatch, that's better. We've had situations before where we've wanted to bump a transient dependency before the direct dependency had bumped it.

[redsun82]

Aha, now I see why dependabot didn't manage to do this update. I'll get back to it on Monday.